Loopscale says deposits and withdrawals are back on for all of its vaults, along with full loan management. It paused the Solana lending protocol on Nov. 5 after what it called a sustained attack campaign. Since Saturday’s announcement, some users have reported that they still could not withdraw or close positions, while others described getting funds out. Loopscale says a technical post-mortem is coming but has given no date.
What Loopscale says it restored
“Deposits and withdrawals for all vaults are now restored, along with full loan management functionality,” Loopscale said in its latest update.
The update replaces a narrower partial reopening from Nov. 6. In that earlier update, Loopscale said collateral top-ups were available for all loans. Repayments were available for every loan except those funded by the USDC Genesis Vault. Borrowers who fully repaid could withdraw their collateral, but collateral withdrawals stayed disabled for USDC Genesis-funded loans. At that point, “Vault withdrawals and all other protocol functionality remain restricted out of an abundance of caution,” the team said.
Read literally, Saturday’s post means Loopscale considers those USDC Genesis limits and the vault-withdrawal freeze lifted. The company has not published figures on how much has been withdrawn since then.
Users report mixed results
Replies to the announcement show that not every user’s experience matches it. One user said that when they tried to close their Loop positions, “the option wasn’t available,” and added, “So basically my funds are still stuck.” The same post also described a separate vault offered by other projects. That separate issue is not evidence of a problem with Loopscale’s own vault withdrawals.
In replies to that post, one user said they had tried two wallets and two vaults and could not withdraw from either. Another said simply, “I can’t withdraw as well.” A third described a workaround: “I partially repaid it and withdraw,” adding that they did it about five times to get their funds back.
Another user reported a split result: “there’s no close position option for loops,” but “the system is allowing me to withdraw my sol from lend vaults.”
These are individual, unverified accounts. AltcoinReporter has not tested withdrawals or reviewed transactions, and the reports do not by themselves establish the cause. A search of Loopscale’s public posts since Nov. 7 found no newer update or technical post-mortem at the time of writing; that scoped search does not rule out responses elsewhere.
How the incident unfolded
Loopscale first disclosed the problem on Nov. 5. It said that over the previous week it had been “targeted in a sustained campaign by a sophisticated actor, with the protocol APIs receiving more than 30,000 malicious requests per day.” It paused activity after what it called a significant escalation. It said the attempts targeted the SOL and USDC Genesis Vaults.
The Nov. 6 update gave more detail on two attack paths, which Loopscale said had both been identified and contained.
SOL Genesis Vault: The attacker used “a misconfigured combination of asset-pricing parameters that caused deposited collateral to be valued as a different asset.” That enabled an undercollateralized loan of about $412,000, Loopscale said.
USDC Genesis Vault: The attacker later used an atomic transaction bundle to sell a loan with an extreme interest rate into the vault. That inflated the vault’s net asset value and enabled what Loopscale described as a disproportionate redemption of about $521,000. The team said its systems halted that redemption “within 30 seconds of transaction generation.”
The two figures describe separate attack paths. Loopscale has not said how much, if any, actually left the protocol for good.
What “made whole” does and does not settle
Loopscale’s assurances to depositors have been firm. On Nov. 5 it said, “Affected vaults have been made whole and no user deposits have incurred a loss.” The Nov. 6 update offered a forward-looking assurance: “No user deposits will incur a loss.” The later wording does not explain how the earlier make-whole claim was funded or reconcile the two statements.
Those are the protocol’s own statements. Loopscale has not said where any make-whole funds came from or how much was needed. It also hasn’t published an independent review of the accounting. Reopening withdrawals does not by itself show how any shortfall was covered.
The root cause is only partly public, and Loopscale has not yet said what it changed to close those paths. Its Nov. 5 statement said the protocol would not resume normal operations “until we have established the complete scope of the campaign and implemented further security hardening.” The post-mortem should show whether it did.
Context for lenders and borrowers
For comparison, Swell reopened swETH and rswETH withdrawals after resetting exchange rates that had been manipulated. The incidents involved different mechanisms; Swell’s reopening is not evidence that Loopscale withdrawals are working.
The post-mortem is the next thing to watch, along with any account of losses and how they were covered. Until then, the depositor-safety claims rest on Loopscale’s statements alone.
FAQ
Can Loopscale users withdraw from all vaults now? Loopscale says deposits, withdrawals and full loan management are restored for all vaults. Some users have since reported being unable to withdraw or close loop positions, while others reported withdrawing SOL or recovering funds through partial repayments. Those reports are unverified.
Did depositors lose money? Loopscale said affected vaults were made whole and no user deposits incurred a loss. It has not published the source or size of any make-whole funds, and no independent review has been released.
How much was taken in the attack? Loopscale cited an undercollateralized loan of about $412,000 and a halted redemption of about $521,000 on two separate paths. It has not disclosed a net loss figure.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
