Loopscale pauses lending after 30,000 daily malicious API requests

Loopscale described the campaign in a November 5, 2026, statement as the work of a “sophisticated actor.” Its security systems detected a sharp escalation, and the team paused protocol activity to limit the impact. A team member said on the official Discord channel that the incident targeted the protocol’s older Genesis vaults. The investigation is continuing, but Loopscale has not disclosed how much money was affected or how the attacker tried to compromise the vaults.

The protocol plans to reopen its interface and restore loan repayments, though it has not given a timetable. Repayments are a priority because borrowers may need to reduce debt and maintain collateral requirements; without access, some could face unexpected liquidations. Reopening the interface will not mean a full return to service, which remains subject to the security review and additional safeguards.

Loopscale said it identified four addresses linked to the suspicious activity: two Solana addresses and two in an Ethereum-compatible format. The team is working with federal law enforcement and security professionals. It has not named the suspected attacker or the agencies involved.

The pause follows an April 2025 exploit that cost Loopscale approximately $5.8 million. On April 26, an attacker manipulated the pricing of RateX principal tokens and withdrew approximately 5.7 million USDC and 1,200 SOL. The protocol suspended markets and restricted withdrawals, then agreed to a 10% whitehat bounty for the return of the funds. The attacker was offered approximately 3,947 SOL and immunity from legal action in exchange for cooperating. By April 28, the remaining 19,999 SOL had been returned to a Loopscale-controlled wallet. Services later resumed in stages, with repayments and position-closing restored before vault withdrawals.