<h2 id="b-tldr-b">TLDR:</h2>
<ul>
 <li style="font-weight: 400">Loopscale suspended operations after its APIs received more than 30,000 malicious requests daily.</li>
 <li style="font-weight: 400">An attacker exploited a kySOL collateral pricing mismatch to borrow 4,597 SOL from Genesis Vaults.</li>
 <li style="font-weight: 400">Loopscale confirmed that affected vaults were restored, with no reported losses to user deposits.</li>
 <li style="font-weight: 400">The protocol identified four addresses and is working with law enforcement and security professionals.</li>
</ul>
Solana Protocol Loopscale has suspended operations following a weeklong attack targeting its APIs and Genesis Vaults. 
The protocol reported more than 30,000 malicious requests daily. However, affected vaults have been restored, with no reported losses to user deposits.
<h2 id="b-loopscale-detects-sustained-api-attack-targeting-genesis-vaults-b">Loopscale Detects Sustained API Attack Targeting Genesis Vaults</h2>
Loopscale said its security systems detected an escalation in the attack campaign over the past week. The team subsequently paused protocol activity to contain the threat. The attackers specifically targeted its <a href="https://blockonomi.com/solana-records-97-tokenized-equities-volume-as-sofi-cash-app-join-the-network/" rel="noopener noreferrer nofollow">SOL</a> and USDC Genesis Vaults.
According to the protocol, its application programming interfaces received more than 30,000 malicious requests daily. 
The sustained activity formed part of a campaign attributed to a sophisticated attacker. Loopscale suspended operations after identifying increased security risks.
<div class="embed-x">
 <blockquote class="twitter-tweet">
 Over the past week, Loopscale has been targeted in a sustained campaign by a sophisticated actor, with the protocol APIs receiving more than 30,000 malicious requests per day. All deposited user funds are secured.
 Earlier, our security systems detected a significant escalation…
 — Loopscale (@Loopscale) <a href="https://x.com/Loopscale/status/2118285556123611378?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">November 5, 2026</a>
 </blockquote>
</div>
Researchers also uncovered a collateral-pricing exploit involving kySOL, a liquid staking token. The attacker reportedly misrepresented a single kySOL token as zBTC collateral. A decimal mismatch subsequently caused its recorded value to increase sharply.
The pricing discrepancy allowed the borrower to withdraw 4,597 SOL using the misrepresented collateral. The attacker then bridged the withdrawn funds away from the protocol.
 The collateral classification error distorted the vault’s valuation process, enabling the borrower to access funds against incorrectly valued collateral.<a href="https://moneycheck.com/solana-sol-rallies-to-72-genuine-comeback-or-temporary-relief-rally/" rel="noopener noreferrer nofollow"> Loopscale</a> has not resumed normal operations.
<h2 id="b-loopscale-restores-affected-vaults-as-investigation-continues-b">Loopscale Restores Affected Vaults as Investigation Continues</h2>
Despite the attack, Loopscale confirmed that affected <a href="https://parameter.io/kraken-introduces-yield-earning-vaults-for-tokenized-nvidia-nvda-stocks/" rel="noopener noreferrer nofollow">vaults</a> have been made whole. The team stated that no user deposits have incurred losses. It also confirmed that all deposited funds remain secured throughout the suspension.
The protocol plans to re-enable its interface shortly. Meanwhile, repayment functionality is expected to return as soon as possible. Loopscale said restoring repayments remains a priority to help prevent unforeseen liquidations during the suspension.
However, normal operations will remain paused until the investigation establishes the campaign’s complete scope. The team also intends to implement additional security hardening before reopening the protocol. These measures form part of its recovery process.
Loopscale has identified four addresses connected with the attack and is working with federal law enforcement and security professionals. 
The published addresses include two Solana-format addresses and two <a href="https://coincentral.com/ethereum-eth-price-network-addresses-double-in-a-week-as-bulls-defend-1850-support/" rel="noopener noreferrer nofollow">Ethereum-format addresses.</a> The team has not announced a full resumption date.
The latest incident also follows an earlier pricing-related event involving the same Genesis Vaults in April 2025. Consequently, this marks the second reported pricing-related incident affecting these vaults since April 2025.
 Loopscale said it would continue sharing relevant information and material updates as they become available.
The post <a href="https://blockonomi.com/loopscale-halts-solana-protocol-after-weeklong-api-attack/" rel="noopener noreferrer nofollow">Loopscale Halts Solana Protocol After Weeklong API Attack</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Loopscale Halts Solana Protocol After Weeklong API Attack

Table of Contents

Blockonomi

Other articles published on Nov 5, 2026

Join our free newsletter for daily crypto updates!