Loopscale Partly Restores Loan Functions, Keeps Vault Withdrawals Frozen

Loopscale said it restored collateral top-ups for all loans and repayments for all except those funded by its $USDC Genesis Vault, partially reopening the Solana lending protocol while keeping vault withdrawals frozen.

In a Nov. 5 evening update, the protocol said borrowers who fully repay loans can reclaim their collateral, except for loans funded by the $USDC Genesis Vault. All other protocol functionality remains restricted.

The reopening addresses a concern Loopscale raised in its initial pause statement: restoring repayments to mitigate unforeseen liquidations. It said the pause followed an escalation in a week-long campaign that generated more than 30,000 malicious requests a day to its application programming interfaces, or APIs.

Two Attack Paths

Loopscale said it had identified and contained two attack paths involving its program logic and private transaction-building APIs. In the first, misconfigured pricing parameters caused a borrower's collateral to be valued as a different asset, enabling an undercollateralized loan of approximately $412,000 from the $SOL Genesis Vault, according to the protocol.

A Nov. 1 onchain transaction involving a wallet Loopscale identified shows a loan drawing 4,597 $SOL after depositing 1 kySOL, a restaked $SOL token. The collateral deposit paired the kySOL token with a zBTC asset identifier, corroborating the protocol's account of an asset mismatch.

A Nov. 3 liquidation of the same loan transferred about 4,598.4 $SOL from a separate wallet back to the lending strategy.

For the second path, Loopscale said a bundle of transactions sold a loan carrying an extreme interest rate into the $USDC Genesis Vault. That inflated the vault's net asset value and enabled a disproportionate redemption of approximately $521,000, which the protocol said its systems halted within 30 seconds of transaction generation.

“No user deposits will incur a loss,” Loopscale said. Its earlier statement said the affected vaults had been made whole.

The same two vaults were affected by an April 26, 2025 attack. Loopscale's post-mortem said a collateral-pricing vulnerability allowed outflows of about 5.73 million $USDC and 1,211.4 $SOL, all subsequently recovered through negotiations.

For the current incident, Loopscale has tied a return to normal operations to establishing the campaign's full scope and implementing further security hardening.

Updated Nov. 5, 2026, to add the partial restoration of loan functions, Loopscale's account of the two attack paths and onchain records of the $SOL loan.