Loopscale reopens its vaults after a $412,000 pricing exploit, but the post-mortem is still missing

Loopscale, a fixed-rate lending protocol on Solana, reopened all of its vaults on Saturday 7 November, ending a freeze that began on 5 November. “Deposits and withdrawals for all vaults are now restored, along with full loan management functionality,” the team posted on X at about 21:40 UTC. The Loopscale hack behind the freeze had two parts: a loan of about $412,000 in SOL that a pricing error let through, and an attempted redemption of about $521,000 from the USDC vault that Loopscale says it stopped within 30 seconds.

Loopscale says depositors lost nothing. It has not yet explained how the two vaults were made whole, and the “full technical post-mortem” it promised in the same post is due “soon”, with no date.

This is the second time in 18 months that the same pair of vaults has been hit. In April 2025, two weeks after the protocol launched publicly, an attacker drained about $5.8 million from them through a different pricing flaw.

A pause first announced as an API attack

Loopscale halted the protocol on Thursday 5 November. Its statement on X, posted at about 10:13 UTC and quoted by Crypto Briefing and crypto.news, said its APIs had received more than 30,000 malicious requests a day for about a week, aimed at the SOL and USDC Genesis Vaults, from what it called a “sophisticated actor”. Its security systems then detected “a significant escalation”, the team wrote, and it paused operations.

The same post said the affected vaults had already been made whole. “All deposited user funds are secured,” Loopscale wrote. It listed four addresses tied to the activity, two on Solana and two on EVM chains, and said it was working with federal law enforcement and security professionals. No agency was named, and no amount was given that day.

The stated priority on 5 November was to restore loan repayments, so that borrowers would not be liquidated while the interface was down. A team member said on Discord that the incident involved the older Genesis vaults, crypto.news reported.

How the Loopscale hack worked: a $412,000 loan and a blocked $521,000 redemption

The figures came the next night. In an update posted on X at about 00:34 UTC on Friday 6 November, Loopscale said it had “identified and contained” two paths, one per vault. Both used multi-step transactions aimed at “publicly inspectable program logic and private transaction-building APIs”, the team wrote.

SOL Genesis Vault: collateral priced as another asset

In the SOL vault, Loopscale said, “a misconfigured combination of asset-pricing parameters” made deposited collateral count as a different, more valuable asset. That produced about $412,000 of undercollateralised lending. This loan was real: the SOL left the vault.

An independent researcher, whose trace NullTX published on 7 November without naming the person, reconstructed it on-chain. On 1 November a wallet deposited a single kySOL, a restaked SOL token, and borrowed 4,597 SOL against it. The attacker had reportedly bought that kySOL for about 1.31 SOL some 154 seconds earlier. One token worth roughly $120 was valued as ten zBTC, a wrapped bitcoin.

The researcher’s explanation is about decimals. On Solana each token records its own precision: kySOL has nine decimals, like SOL, and zBTC has eight. One kySOL is 1,000,000,000 base units, and read with eight decimals that number becomes 10.0. According to the same analysis, the attacker picked a zBTC price entry, labelled the collateral as an Orca position and deposited kySOL; the Orca rule did not require the token mint to match the zBTC identifier, while the rule for plain SPL tokens would have refused it.

That reading belongs to the researcher. Loopscale has not named kySOL or zBTC, and its own wording, a misconfigured mix of pricing parameters, is broader. The post-mortem should settle which parameter failed.

Two days after the loan, on 3 November, it was liquidated. About 4,598.4 wrapped SOL moved from a separate wallet back to the lending strategy, roughly 1.43 SOL more than had been borrowed, and the liquidator took the lone kySOL. The public record does not show who funded that liquidation. NullTX also cites reports that the borrowed SOL was bridged out, which would fit the mix of Solana and EVM addresses Loopscale published; that point is reported, not confirmed.

USDC Genesis Vault: an inflated net asset value

The second path targeted the USDC vault. According to Loopscale, a bundle of atomic transactions sold a loan carrying an extreme interest rate into the vault. That raised the vault’s net asset value on paper and set up a redemption of about $521,000, far more than the position justified. Loopscale says its systems halted it within 30 seconds of the transaction being generated.

So the $521,000 was an attempt, and the two figures should not be added together. Summed, they come to about $933,000, which a PandaSecurity write-up on DEV Community describes as exposure, not a loss to depositors. NullTX reports that Loopscale wants the private API transaction logic hardened along with the smart-contract checks on token mints; the 6 November post itself gives no list of fixes.

The same post brought back part of the protocol: priority loan functions, collateral top-ups on all loans, and repayments on every loan except those funded by the USDC Genesis Vault. Borrowers who repaid in full could take back their collateral, again except on USDC Genesis loans. Vault withdrawals stayed frozen until Saturday night.

What Loopscale has not explained yet

“No user deposits will incur a loss,” Loopscale wrote on 6 November. No outlet has been able to check that claim. Several things remain open:

• How the vaults were made whole, and with whose money. The 3 November liquidation returned slightly more SOL than was lent, which on its face covers the SOL vault, but Loopscale has not said that this is what “made whole” means.
• Whether the 30,000 malicious requests a day were the same activity as the two paths or a separate campaign.
• Who the attacker is. Loopscale has named nobody, and no bounty or negotiation has been reported, unlike in 2025.
• Which parameter was misconfigured, and when it was set. No transaction signatures or program code have been published.
• When the post-mortem will appear. Loopscale says “soon” and nothing more precise.

The DefiLlama hacks list, read at 05:46 UTC on 8 November, logs the incident as “Loopscale Lending” on 5 November, classified as protocol logic, with no amount filled in. Loopscale’s own security documentation says all deployed programs get an external review before release and states: “Lending and liquidation activity is paused if oracle feeds are stale or compromised.” The page names no auditor and lists no past incident, including April 2025.

The April 2025 Loopscale exploit, same vaults

On 26 April 2025 an attacker manipulated the pricing of RateX principal tokens, which Loopscale accepted as collateral, and borrowed far more than the collateral was worth. About 5.7 million USDC and some 1,200 SOL left the SOL and USDC Genesis Vaults, roughly $5.8 million in all. The attacker accepted a 10% whitehat bounty and immunity, and by 28 April 2025 the remaining 19,999 SOL was back in a Loopscale wallet, crypto.news recounts. Repayments came back first; vault withdrawals opened later.

The mechanisms differ: a token’s price feed in 2025, a pricing configuration in 2026. Both are pricing faults in collateral valuation, in the same vaults. NullTX puts the open question plainly: will the post-mortem show safeguards that match how often this class of bug has turned up? Readers new to the pattern can find the common attack types in our explainer on DeFi hacks and oracle attacks.

Reopened vaults, but exits depend on liquidity

Reopening does not mean every depositor can leave at once. Withdrawals “remain subject to available liquidity in the affected vaults”, Phemex wrote in its summary of the reopening. Loopscale’s vaults lend their deposits out as fixed-rate loans through an order book, so the cash a vault can pay out is what is not currently lent. Our guide to how fixed-rate DeFi lending works explains why such loans cannot be called back early.

Borrowers in the USDC Genesis Vault were the last to get relief. Until Saturday they could not repay or withdraw collateral, which kept them exposed if prices moved. SOL traded near $89.10 at 05:38 UTC on 8 November, about 6.9% lower over seven days, according to Coindaro’s market snapshot.

Depositors did not run. Loopscale’s total staking or liquidity, measured at current market prices. It is the main size metric in DeFi.">value locked stood at $90.24 million on 5 November, the day of the pause, and at $85.15 million at 04:21 UTC on 8 November, a fall of about 5.6%, according to DefiLlama data read at 05:48 UTC. Borrowed funds were $35.86 million. The 8 November drop could reflect the first withdrawals after reopening as well as SOL’s price, and the data cannot separate the two.

Solana lenders have had a rough autumn. Jupiter Lend was still short of cash after the Binance hack, as covered in our report on Aave reopening and Jupiter Lend’s liquidity gap, and Drift Protocol’s $295 million hack in October is still the reference case for Solana DeFi risk. The same week as the Loopscale loan, Premia’s option vaults on Arbitrum lost about $437,000 in two transactions.

No deposit guarantee for DeFi lenders

For readers in Europe and the US the rule is the same: money lent through a protocol like Loopscale is not covered by any deposit insurance or investor compensation scheme. MiCA and national licensing regimes apply to service providers that hold client assets, not to a non-custodial lending program. No regulator in the US, France or Italy has commented on the incident. Whether depositors stay whole rests on Loopscale’s word until the post-mortem shows the accounts.

The next date to watch is the post-mortem. Until it is out, nobody outside the team can say which parameter failed or who paid to close the gap.