Loopscale, a decentralized finance protocol on the Solana network, suspended its operations after facing a significant security breach involving sustained API attacks and a collateral-pricing exploit in its Genesis Vaults.
Loopscale suspends service following coordinated attack
Over the past week, Loopscale reported more than 30,000 malicious API requests daily, attributing these to a sophisticated attack campaign. The protocol responded by halting all services to contain the threat and initiated an internal investigation into the security incident.
The attackers specifically targeted Loopscale’s SOL and USDC Genesis Vaults, which resulted in the protocol’s rapid decision to pause user activity. Loopscale emphasized that all deposited user funds were secured throughout the suspension period.
Loopscale highlighted the continual surge in malicious requests, stating that its APIs faced over 30,000 attempts each day by a sophisticated attacker, but reassured users that all deposited funds remain secure.
Researchers traced the incident to an exploit involving kySOL, a liquid staking token. The perpetrator misrepresented a single kySOL token as zBTC collateral, which, due to a decimal mismatch in valuation, resulted in an inflated value. This discrepancy allowed the attacker to borrow 4,597 SOL from Loopscale’s vaults using falsely valued collateral, after which the funds were removed from the protocol.
Following this, Loopscale’s valuation processes were distorted by the token classification error. The protocol has not yet resumed normal operations as it continues its investigation.
Mini dictionary: kySOL is a Solana-based liquid staking derivative token, allowing users to stake SOL while retaining liquidity and utilizing the staked value in DeFi applications.
| Key Event | Details |
|---|---|
| API attack volume | 30,000+ malicious requests daily |
| Stolen collateral | 4,597 SOL borrowed using kySOL exploit |
| User fund impact | No losses reported, vaults restored |
Recovery actions and investigation
Loopscale confirmed that the affected vaults have been restored, and user deposits remain unharmed. The development team stated it plans to re-enable repayment functionality as a priority to mitigate potential liquidation risks during the protocol’s ongoing suspension.
Full operations will stay paused until the investigation concludes and further security measures are implemented. Loopscale is cooperating with law enforcement agencies and external security experts as part of its recovery process.
The team noted that restoring repayment functionality and strengthening protocol security remain top priorities as they continue to assess the scope of the attack.
Four addresses linked to the incident have been identified: two in the Solana address format and two compatible with Ethereum. These have been shared with authorities for further examination, as Loopscale works to trace the flow of the compromised assets.
The protocol has not announced a firm timeline for resuming full service, emphasizing that comprehensive recovery and additional safeguards are required before reopening.
This marks the second major pricing-related incident to affect Loopscale’s Genesis Vaults since April 2025, raising concerns about the need for persistent security improvement. The team stated it will publish any new information and continue to keep its community updated.
