TLDR: Loopscale suspended operations after its APIs received more than 30,000 malicious requests daily. An attacker exploited a kySOL collateral pricing mismatch to borrow 4,597 SOL from Gene
Solana Protocol Loopscale has suspended operations following a weeklong attack targeting its APIs and Genesis Vaults.
The protocol reported more than 30,000 malicious requests daily. However, affected vaults have been restored, with no reported losses to user deposits.
Loopscale said its security systems detected an escalation in the attack campaign over the past week. The team subsequently paused protocol activity to contain the threat. The attackers specifically targeted its SOL and USDC Genesis Vaults.
According to the protocol, its application programming interfaces received more than 30,000 malicious requests daily.
The sustained activity formed part of a campaign attributed to a sophisticated attacker. Loopscale suspended operations after identifying increased security risks.
Over the past week, Loopscale has been targeted in a sustained campaign by a sophisticated actor, with the protocol APIs receiving more than 30,000 malicious requests per day. All deposited user funds are secured.
Earlier, our security systems detected a significant escalation…
— Loopscale (@Loopscale) November 5, 2026
Researchers also uncovered a collateral-pricing exploit involving kySOL, a liquid staking token. The attacker reportedly misrepresented a single kySOL token as zBTC collateral. A decimal mismatch subsequently caused its recorded value to increase sharply.
The pricing discrepancy allowed the borrower to withdraw 4,597 SOL using the misrepresented collateral. The attacker then bridged the withdrawn funds away from the protocol.
The collateral classification error distorted the vault’s valuation process, enabling the borrower to access funds against incorrectly valued collateral. Loopscale has not resumed normal operations.
Despite the attack, Loopscale confirmed that affected vaults have been made whole. The team stated that no user deposits have incurred losses. It also confirmed that all deposited funds remain secured throughout the suspension.
The protocol plans to re-enable its interface shortly. Meanwhile, repayment functionality is expected to return as soon as possible. Loopscale said restoring repayments remains a priority to help prevent unforeseen liquidations during the suspension.
However, normal operations will remain paused until the investigation establishes the campaign’s complete scope. The team also intends to implement additional security hardening before reopening the protocol. These measures form part of its recovery process.
Loopscale has identified four addresses connected with the attack and is working with federal law enforcement and security professionals.
The published addresses include two Solana-format addresses and two Ethereum-format addresses. The team has not announced a full resumption date.
The latest incident also follows an earlier pricing-related event involving the same Genesis Vaults in April 2025. Consequently, this marks the second reported pricing-related incident affecting these vaults since April 2025.
Loopscale said it would continue sharing relevant information and material updates as they become available.
The post Loopscale Halts Solana Protocol After Weeklong API Attack appeared first on Blockonomi.
