Solana-based lending protocol Loopscale was exploited for $5.8 million on Saturday, about two weeks after its launch on April 10.
Solana-based lending protocol Loopscale was exploited for $5.8 million on Saturday, about two weeks after its launch on April 10. The attacker drained roughly 5.7 million USDC and 1,200 SOL through a series of undercollateralized loans. Loopscale said the exploit was caused by a vulnerability tied to how RateX-based collateral was priced. As a result of the breach, the team temporarily disabled withdrawals, loan repayments, and other features to prevent further loss. Some functions, like repayments, top-ups, and loop closures, have since been re-enabled, but vault withdrawals and new deposits remain suspended.
The exploit impacted about 12% of Loopscale’s total value locked (TVL), which had reached around $40 million before the incident. The team said on X that they are investigating how the exploit occurred, who was behind it, and the best path for potential fund recovery. Loopscale is also working with law enforcement agencies.
Originally known as Bridgesplit, Loopscale was founded to create a different lending model from traditional pool-based platforms like Aave or Solend. Instead of pooling liquidity, it matches lenders and borrowers directly through an order book system. The platform supports over 40 token pairs and enables specialized lending strategies such as structured credit and receivables financing. Its USDC vault offered more than 5% APR, while the SOL vault offered yields over 10%. Before the hack, the platform had attracted about 7,000 lenders.
Loopscale had undergone a security audit by OShield between January and February 2025. Several critical vulnerabilities were found during the audit, but according to Loopscale’s documentation, all critical and high-risk issues were fixed. A second audit by Sec3 was still underway at the time of the hack. Despite these security measures, the exploit exposed serious weaknesses.
Mary Gooneratne, a co-founder of Loopscale, posted on X that the team is fully mobilized to investigate and recover the stolen assets. Loopscale has not provided a detailed timeline for when full functionality might resume and did not immediately respond to media requests for further comments.
The incident comes amid a spike in crypto exploits in early 2025. In the first quarter alone, PeckShield reported that $1.6 billion worth of crypto assets were stolen, most notably including the $1.5 billion Bybit hack attributed to North Korea’s Lazarus Group. Other projects like KiloEX and Infini have also suffered losses.
Loopscale had completed a six-month closed beta phase before going live in April, aiming to introduce a more efficient lending model on Solana. The attack has raised concerns about ongoing security risks even for recently audited and newly launched DeFi platforms. Loopscale continues to update its users as investigations progress.
This article contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators.
This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice.
The views and opinions expressed in this article are the author’s [company’s] own and do not necessarily reflect those of CoinMarketCap.
