Solana lending protocol Loopscale has frozen all deposits and withdrawals after a week-long assault on its vaults, the protocol announced on November 5. The freeze is the latest reminder that in decentralised finance, the attack surface is not only the smart contract — it is everything around it.
Loopscale said it had been absorbing more than 30,000 malicious API requests a day for roughly a week, aimed squarely at the SOL and USDC Genesis Vaults that sit at the centre of its lending markets. On November 5 the protocol paused all activity while it investigates who was responsible and how the attacks unfolded. The affected vaults have been fully replenished, Loopscale said, and user deposits suffered no losses. The team published four wallet addresses linked to the attacks and said it is working with federal law enforcement and security specialists. Normal operations will remain suspended until the attack's scope is understood and additional safeguards are in place — although Loopscale plans to restore its interface and repayment functions sooner, to reduce liquidation risks for borrowers who cannot currently adjust their positions.
Real money, frozen in place
Loopscale is not a small player by Solana DeFi standards. DefiLlama puts its total value locked at roughly $90.2 million as of November 5, and the protocol has facilitated more than $2 billion in loans since launch. That is real money sitting idle right now, with depositors unable to withdraw or adjust positions until the team says otherwise. Their funds are, per the protocol's own claim, intact and sitting in replenished vaults. But they are also frozen, with no stated timeline for when lending and borrowing resume. Loopscale has not published a formal post-mortem yet.
The key numbers: 30,000+ — malicious API requests per day aimed at the SOL and USDC Genesis Vaults, for about a week; $90.2M — Loopscale's total value locked (DefiLlama, Nov 5); $2B+ — loans facilitated by the protocol since launch; 4 — wallet addresses published by the team as linked to the attacks; 0 — user losses claimed by Loopscale; affected vaults fully replenished.
A different kind of attack
The company has said this second incident is different in kind: a volumetric assault on its API rather than a pricing exploit on its smart contracts. That distinction matters, because it widens the lesson. DeFi security is usually discussed in terms of audited code and oracle prices — but a protocol's API, its interface and its off-chain infrastructure can be attacked too, and when they are, the protocol's only safe move may be to stop everything.
Loopscale has been here before. In April 2025, an attacker exploited a flaw in how the protocol validated pricing for RateX principal tokens used as collateral. The attacker drained roughly 5.7 million USDC and 1,211 SOL, about $5.8 million combined, in minutes. That single exploit represented around 12% of the protocol's total value locked at the time, according to reporting from The Block and Halborn's post-incident writeup. Loopscale ultimately restored all affected funds after an on-chain negotiation in which the attacker agreed to return assets in exchange for a bounty, and withdrawals reopened on May 8. This time there was no smart-contract drain — but the response is the same: pause, investigate, replenish, and only then reopen.
The wider lending market keeps growing
The freeze lands in a lending sector that is otherwise holding up. As of November 5, the 105 lending protocols tracked by InsideBitcoins hold $52.07 billion between them, up 0.3% over seven days. Aave V3 is the largest with $15.92 billion, about 31% of the sector, followed by Morpho Blue at $11.37 billion and SparkLend at $5.48 billion. Total value locked across all of DeFi stands at roughly $84.2 billion (DefiLlama, Nov 5), with $292.5 billion in stablecoins and $9.5 billion in 24-hour DEX volume.
That context is important for anyone reading the Loopscale news as a verdict on DeFi itself. It is not. It is a verdict on one protocol's infrastructure under sustained attack — and on how seriously a team takes user funds when it chooses to freeze everything rather than risk a worse outcome. For readers who want to understand the mechanics behind lending markets — how collateral, liquidation and yields actually work — our guide to impermanent loss explains the risks that sit underneath every DeFi position, and our blockchain finality explainer covers how transactions become irreversible on-chain. The full Loopscale report is at Startup Fortune.
FAQ
What happened to Loopscale? On November 5, the Solana lending protocol paused all activity after absorbing more than 30,000 malicious API requests a day for about a week, aimed at its SOL and USDC Genesis Vaults. The team says the vaults were fully replenished and no user deposits were lost.
Can I withdraw my funds from Loopscale right now? No. Deposits and withdrawals are frozen until the protocol understands the attack's scope and adds safeguards. The team plans to restore its interface and repayment functions sooner than full lending and borrowing, to reduce liquidation risks.
How big is Loopscale? DefiLlama puts its total value locked at roughly $90.2 million as of November 5, and the protocol has facilitated more than $2 billion in loans since launch.
Has Loopscale been attacked before? Yes. In April 2025 an attacker exploited a pricing-validation flaw for RateX tokens and drained about $5.8 million (5.7 million USDC and 1,211 SOL). The funds were restored after an on-chain negotiation and a bounty, and withdrawals reopened on May 8.
Is DeFi lending as a whole in trouble? No — the sector holds $52.07 billion across 105 lending protocols, up 0.3% over the past seven days, and total DeFi TVL is about $84.2 billion. The Loopscale freeze is a single-protocol incident, not a sector-wide failure.
This is market news and general information only, not financial advice. Follow DeFi and the rest of the market on the Zimbuck News page and in the Zimbuck Market News group, and join the conversation on Zimbuck — the finance social platform for traders and investors.
