Loopscale reopens vaults and loans after attacks on SOL and USDC Genesis

Loopscale reports a sustained campaign during the preceding week and says a detected escalation triggered its protocol pause. Its over-30,000 daily malicious-request figure is a vendor estimate, not a count of successful attacks or affected users. The notice identifies SOL and USDC Genesis vaults as targets and says affected vaults have been made whole without loss to user deposits. The November 5 notice did not quantify either path or identify how the replacement was funded.

Loopscale initially tied reopening to confirming the scope and applying further security measures. It announced partial restoration on November 6 and full vault and loan functionality on November 7. It says it is cooperating with federal law enforcement and security professionals. The November 6 confirmation of actual exploitation warrants L4. No CVE, patched software version or Solana-wide compromise is established.

Earlier reporting and disputed replacement: On November 3, Andrew Seb alleged that a November 1 loan of 4,597 SOL (about $431,000 at the researcher’s valuation) used one kySOL misidentified/priced as zBTC, with a decimal mismatch; the loan allegedly expired unpaid on November 2. On November 5, the researcher separately claimed a 586,000-USDC withdrawal after a 65,000-USDC deposit, about $520,000 net, and no return visible by 11:50 UTC. These figures and mechanisms are unverified researcher claims, not vendor-confirmed losses, and are not added together. The later post disputes replenishment, but a token-account snapshot does not settle off-account replacement commitments or customer-wide compensation. The vendor’s statement is retained as its claim, not independently established recovery. The public disclosure date follows the earlier November 3 report, not the alleged theft date or later vendor acknowledgment.

November 6 attack paths and recovery. Loopscale attributes the SOL vault attack to a combination of pricing settings that valued collateral as a different asset, allowing an undercollateralized loan of about $412,000. It says an atomic bundle sold an extreme-interest loan into the USDC vault and inflated its net asset value. Loopscale reports about $521,000 in disproportionate redemption and says its systems halted the activity within 30 seconds of transaction generation and that depositors will incur no loss. These are distinct vendor-reported amounts. The announcement does not reconcile them with the researcher’s earlier figures or independently establish net losses, how replacement was funded or repayment to individual users.

November 7 reopening. Loopscale says the November 6 restrictions have been lifted, including those on loans funded by USDC Genesis. Normal vault liquidity rules still apply. The reopening notice does not provide a final loss or replenishment accounting, detail the hardening measures or give a date for the technical postmortem.