Loopscale pauses operations after sustained attack on its Genesis Vaults

Loopscale is a Solana lending protocol built around 'Genesis Vaults', pooled vehicles for SOL and USDC that route capital into fixed-rate loans. Unlike hacks that drain smart-contract funds directly, this incident targeted the platform's API layer, a vector DeFi has seen exploited before without touching on-chain logic itself. Loopscale paused all activity on November 5 once its monitoring systems flagged the sustained malicious traffic pattern hitting those two vaults.

Depositors lost access to Genesis Vault funds for days, though Loopscale maintained no losses occurred during the freeze. Loan functions returned unevenly: some borrower controls came back first, while anyone holding a USDC Genesis-funded loan still could not repay debt or withdraw collateral, extending restrictions well past the initial suspension. Only with the later full reopening, covering the USDC Genesis Vault itself, did every loan-management limit finally lift for users.

Loopscale's ability to unilaterally freeze repayments and collateral withdrawals on specific loans is a centralized safety valve that protected funds, but it sits awkwardly against permissionless lending's usual promise of continuous, rules-only access. Attackers working through API request volume rather than contract exploits show that off-chain infrastructure can remain the soft target even when on-chain accounting stays intact, exposing a gap between smart-contract audits and request-layer security.

Loopscale has committed to a technical post-mortem following its decision to reopen every vault, including the previously frozen USDC Genesis Vault. That report should spell out the two attack paths identified during the repayment and collateral freeze, and whether changes beyond request-rate limits are coming before depositors can judge if Genesis Vaults' API defenses have actually closed the gap attackers found.