Solana-based lending protocol Loopscale has suspended operations following a weeklong attack campaign directed at its application programming interfaces and its Genesis Vaults, which hold user deposits in SOL and USDC. According to the protocol, its APIs received more than 30,000 malicious requests per day during the sustained campaign, which the team attributed to a sophisticated actor. Affected vaults have since been restored, and no losses to user deposits have been reported.

Security Escalation Prompts Protocol-Wide Pause

Loopscale said its security systems detected a significant escalation in the attack campaign over the past week, prompting the team to pause protocol activity to contain the threat. The attackers specifically targeted the protocol's SOL and USDC Genesis Vaults, and the sustained request activity formed part of a broader campaign attributed to a sophisticated attacker. The team confirmed the suspension after identifying increased security risks. APIs are the interface layer through which applications and services communicate with a protocol, meaning an attack at this level can disrupt platform operations without directly touching on-chain balances — consistent with the team's report that user deposits remained secured throughout.

The protocol disclosed the campaign in a statement posted on X on November 5, 2026:

Over the past week, Loopscale has been targeted in a sustained campaign by a sophisticated actor, with the protocol APIs receiving more than 30,000 malicious requests per day. All deposited user funds are secured. Earlier, our security systems detected a significant escalation…

— Loopscale (@Loopscale) November 5, 2026

kySOL Pricing Mismatch Enabled 4,597 SOL Borrowing

Researchers also uncovered a collateral-pricing exploit involving kySOL, a liquid staking token used as collateral within the vaults. Collateralized lending depends on valuing deposited assets accurately, because borrowing capacity is sized against that valuation — and token amounts are recorded numerically, so a decimal misinterpretation can sharply inflate a position's recorded value. That dynamic sat at the core of the exploit: the attacker misrepresented a single kySOL token as zBTC collateral, and a decimal mismatch subsequently caused the token's recorded value to increase sharply.

The pricing discrepancy allowed the borrower to withdraw 4,597 SOL using the misrepresented collateral. The attacker then bridged the withdrawn funds away from the protocol. According to Loopscale, the collateral classification error distorted the vault's valuation process, enabling the borrower to access funds against incorrectly valued collateral. The protocol has not resumed normal operations.

Affected Vaults Restored as Investigation Continues

Despite the exploit, Loopscale confirmed that the affected vaults have been made whole. The team stated that no user deposits have incurred losses and reiterated that all deposited funds remained secured throughout the suspension. In effect, the incident's impact was operational: deposits were restored even as the platform itself stayed offline.

The protocol plans to re-enable its interface shortly, while repayment functionality is expected to return as soon as possible. Loopscale said restoring repayments remains a priority, as it aims to help prevent unforeseen liquidations while the suspension remains in place. Normal operations, however, will stay paused until the investigation establishes the campaign's complete scope. The team also intends to implement additional security hardening before reopening the protocol, as part of its recovery process. The milestones that now frame the recovery are the interface's return, the restoration of repayments, the completed mapping of the campaign's scope, and the hardening work slated to precede any reopening.

Loopscale has identified four addresses connected with the attack and is working with federal law enforcement and security professionals. The published addresses include two Solana-format addresses and two Ethereum-format addresses. The team has not announced a date for a full resumption of operations.

Second Pricing-Related Incident Since April 2025

The latest incident follows an earlier pricing-related event involving the same Genesis Vaults in April 2025, making this the second reported pricing-related incident to affect the vaults since that time. The recurrence places the vaults' pricing mechanics — the element exploited in the kySOL incident — and the API layer targeted by this week's campaign under scrutiny as the team's hardening work proceeds. Loopscale said it will continue to share relevant information and material updates as they become available.