Solana Lender Loopscale Reopens All Vaults After Attack-Related Freeze

Loopscale said on Nov. 7 that deposits and withdrawals had resumed across all of its vaults, alongside “full loan management functionality,” reopening the Solana-based lending protocol after an attack-related pause.

Vault withdrawals had been restricted since at least the protocol's Nov. 5 pause announcement, roughly two and a half days before Saturday's reopening update.

Partial Reopening Preceded Full Restoration

The restoration includes the $USDC Genesis Vault. During a partial reopening previously reported by The Defiant, borrowers funded by that vault had remained unable to repay loans or withdraw collateral. Other borrowers could repay and reclaim collateral after full repayment, and collateral top-ups were available for all loans, but withdrawals from all vaults stayed frozen.

Loopscale's vaults pool a single asset and lend it across borrowing markets. The $USDC Genesis Vault's public interface showed roughly $7 million supplied. Restored access does not mean unlimited immediate withdrawals: the protocol's documentation notes that withdrawals remain subject to available liquidity.

Loss Accounting and Security Details Pending

In its initial pause statement, Loopscale said the affected $SOL and $USDC Genesis vaults had been made whole and that no user deposits incurred a loss.

In a subsequent account of the incident, the team said it had identified and contained two attack paths, involving program logic and private transaction-building APIs. It attributed an undercollateralized loan of approximately $412,000 drawn from the $SOL Genesis Vault to pricing parameters that valued deposited collateral as a different asset. Lending protocols size loans against the recorded value of posted collateral, which is why a pricing mismatch can leave a borrow position undercollateralized.

For the $USDC Genesis Vault, Loopscale said a bundle of transactions sold a loan carrying an extreme interest rate into the vault, inflating its net asset value — the figure against which vault redemptions are calculated — and enabling a disproportionate redemption of roughly $521,000. According to the team, its systems halted that activity within 30 seconds of transaction generation.

Loopscale had tied a return to normal operations to establishing the attack campaign's full scope and implementing further security hardening. Its reopening statement did not detail those changes or provide a final loss-and-recovery accounting. The team promised a full technical post-mortem “soon,” without setting a publication date.