Loopscale pauses Solana lending protocol after week-long attack campaign on SOL and USDC Genesis Vaults

Summary

On 5 November 2026 Loopscale, a Solana lending protocol, said a "sophisticated actor" had targeted it for the past week. Its APIs received more than 30,000 malicious requests per day, and the attack attempts targeted the SOL and USDC Genesis Vaults. After its security systems detected a significant escalation, Loopscale paused protocol activity. It published four addresses it identified in connection with the activity.

Affected

• Loopscale lending protocol (Solana): SOL and USDC Genesis Vaults
• Fixed in: protocol paused; Loopscale says normal operations will not resume until it has established the full scope of the campaign and hardened security further

Impact

Loopscale states that the affected vaults have been made whole and no user deposits have incurred a loss. Loopscale has not published a loss figure or a technical root cause. Third-party reports of the mechanism and amount differ and are not confirmed by Loopscale. Loopscale says it is working with federal law enforcement and security professionals.

Recommended actions

• Do not interact with the addresses listed as indicators. Screen them in compliance and blocklist tooling.
• Borrowers: watch Loopscale's official channels for when repayments resume, so positions are not liquidated unexpectedly. Loopscale says it is prioritising repayment functionality.
• Integrators and curators: review exposure to Loopscale Genesis Vaults until Loopscale publishes a full post-mortem.

Source & attribution

This 0xCERT advisory summarises Loopscale's own statement: https://x.com/Loopscale/status/2118285556123611378. The incident is also recorded in the DeFiLlama hacks database (https://defillama.com/hacks). The indicators are copied verbatim from Loopscale's post. Details may change; refer to the original source for the authoritative record.