Loopscale pauses operations after sustained attack on its Genesis Vaults

Loopscale built its Genesis Vaults as a Solana lending product that routes SOL and USDC deposits into yield strategies, a model common since Solend and other Solana lenders popularized vault-based lending after 2021. Unlike a smart-contract exploit draining funds directly, this incident targeted the API layer that vaults depend on for off-chain coordination, a less-discussed attack surface than the audited contracts themselves.

Borrowers and depositors in USDC Genesis-funded loans cannot repay loans or withdraw collateral while the freeze holds, even though other loan functions have returned. Users with SOL-side exposure appear to have regained more normal access, creating a two-tier situation where capital sits locked depending on which vault funded the position. Anyone relying on Loopscale for active credit lines must wait on the protocol's own timeline rather than execute standard DeFi actions.

A protocol can pass contract audits and still fail at the infrastructure layer that handles request traffic, and 30,000 malicious requests a day shows attackers probing exactly that gap rather than the blockchain logic. This complicates the usual DeFi security narrative, which focuses almost entirely on code audits and bug bounties. Whether Loopscale's API defenses get hardened before relaunch, or whether this becomes another case of off-chain plumbing undermining on-chain guarantees, is the real test here.

Loopscale's own disclosure of 'two attack paths' against the Genesis Vaults is the detail to track: a full technical post-mortem naming both vectors would clarify whether the fix is a patch or a redesign. Until USDC Genesis-funded loan withdrawals reopen, the protocol's claim that deposits remain unharmed stays only partially tested. The next statement on when repayments and collateral withdrawals resume will show whether this was contained in days or stretches into a longer rebuild.