Loopscale

What happened

In early November 2026, Solana lending protocol Loopscale faced a sustained campaign involving high-volume malicious API requests. Attackers exploited misconfigured asset-pricing parameters to take undercollateralized loans and attempt disproportionate redemptions from the SOL and USDC Genesis Vaults. The team paused the protocol on November 5, stated that affected vaults were made whole, and confirmed no user deposit losses, while coordinating with law enforcement.

Details

Date

Nov 1, 2026

Kind

Hack or exploit

Method

Smart Contract Vulnerability

How in

Smart contract bug

Target

DeFi protocol or token (estimate: SlowMist chain category)

Chains

Solana

What would have stopped it all controls for this way in

• The audit covers the code that ships, including upgrades and new modules; changed code is reviewed again.
  Check: The deployed bytecode matches the audited commit; a diff since the last audit is empty or reviewed.
• A whitehat Safe Harbor or bounty offer is published before any attack, so a rescuer or an attacker has a set way to return funds.
  Check: The terms and the return address are public and fixed in advance.

General guidance for this kind of attack, not a finding about this incident.

After the theft

Victims reimbursed

yes, amount not stated
“The team paused the protocol on November 5, stated that affected vaults were made whole, and confirmed no user deposit losses, while coordinating with law enforcement.” (SlowMist Hacked)

How sure: 0 of 4 checks what the checks mean

• Witnessesone source so far
• Same storyneeds a second source
• Blockchain receiptno public attack transaction checked
• Official wordno official statement linked

Who says what

• SlowMist Hacked ↗no figure

Related incidents