Loopscale Reopens All Vaults After Attack, Withdrawals Back On

Loopscale said on Nov. 7 that deposits and withdrawals are live across all vaults again, alongside full loan management functionality. The Solana lending protocol had kept vault withdrawals restricted since at least its Nov. 5 pause announcement, roughly two and a half days of locked doors. The USDC Genesis Vault, which carried the tightest restrictions, is included in the restart.

In the partial reopening previously reported by The Defiant, borrowers funded by the USDC Genesis Vault still could not repay loans or pull their collateral. Other borrowers could repay and reclaim collateral after settling loans in full, and collateral top-ups were open to everyone, but withdrawals from every vault stayed frozen. Loopscale's vaults pool a single asset and lend it across borrowing markets, and the USDC Genesis Vault's public interface showed about $7 million supplied.

One caveat for anyone rushing the exit: restored access does not mean unlimited immediate withdrawals. The protocol's documentation says withdrawals remain subject to available liquidity.

Loopscale's initial pause statement said the affected SOL and USDC Genesis vaults had been made whole, with no user deposits taking a loss. In its later account of the incident, the team said it had identified and contained two attack paths, one involving program logic and one involving private transaction-building APIs.

The specifics are sharp. An undercollateralized loan of approximately $412,000 from the SOL Genesis Vault traced back to pricing parameters that valued deposited collateral as a different asset. On the USDC Genesis Vault side, Loopscale said a bundle of transactions sold a loan carrying an extreme interest rate into the vault, inflating its net asset value and enabling a disproportionate redemption of approximately $521,000. The team said its systems halted that activity within 30 seconds of transaction generation.

Loopscale had tied a return to normal operations to establishing the full scope of the campaign and implementing further security hardening. Its reopening statement did not detail those changes or provide a final loss-and-recovery accounting. It promised a full technical post-mortem soon, without setting a publication date.