Solana-based lending protocol Loopscale has temporarily suspended operations after a week-long campaign of malicious API requests targeted its SOL and USDC Genesis vaults, the team said on November 5, 2026. Loopscale said its security systems detected a significant escalation after the protocol’s APIs received more than 30,000 malicious requests per day over the past week.
The team described the activity as the work of a sophisticated actor and said it immediately paused protocol activity to limit impact. All deposited user funds are secured, the protocol stated, and the affected vaults were made whole with no users suffering losses.
A Loopscale team member confirmed on Discord that the incident involved the protocol’s older Genesis vaults and that investigations were continuing. The protocol has not disclosed the amount of funds affected or how the attacker attempted to compromise the vaults. Loopscale identified four addresses associated with the suspicious activity, including two Solana addresses and two addresses in Ethereum-compatible format, and is working with federal law enforcement and security professionals.
Although the protocol remains paused, Loopscale intends to reopen its user interface shortly and is prioritizing loan repayment functionality. The team said restoring repayments is critical because borrowers could otherwise face unexpected liquidations while normal lending operations are unavailable. No specific timetable has been provided for full resumption of operations.
The latest incident follows an April 2025 exploit that drained approximately $5.8 million from Loopscale. The attacker manipulated the pricing of RateX principal tokens and withdrew roughly 5.7 million USDC and 1,200 SOL. The team later reached an agreement with the attacker, who accepted a 10% whitehat bounty and returned the remaining funds. Loopscale then restored services in stages, beginning with loan repayments and position-closing functionality.
