Loopscale hack — April 2025

Loopscale, a Solana lending protocol, was exploited on 26 April 2025, sixteen days after launch. Roughly $5.8 million left its Genesis vaults - 5,726,724.97 USDC and 1,211.4 SOL - about 12% of deposits, affecting 3,126 USDC depositors and 2,047 SOL depositors.

The protocol accepted RateX principal tokens as collateral but, as its post-mortem states, validated the RateX program only partially. The attacker deployed a malicious program that spoofed the interface of a valid RateX market and returned artificially inflated exchange rates. Loopscale's pricing logic accepted those values, so a series of loans that were in fact heavily undercollateralised passed its checks and the attacker withdrew far more than they had posted.

Loopscale froze new lending, restored repayments and loop closures the same evening, and offered the attacker a whitehat deal: retain a bounty of 10% of the funds - 3,947 SOL, about $594,000, against a total of roughly 39,500 SOL-equivalent - and a release from all liability. The attacker signalled a willingness to return the funds on 27 April. Returns began at 6:54 PM on 27 April and settled on 29 April between 7:16 and 7:33 PM. The post-mortem records the full 5,726,724.97 USDC and 1,211.4 SOL recovered and does not record any bounty being retained. Loopscale reimbursed a $29,000 discrepancy caused by the attacker having swapped USDC at less favourable rates, so no depositor lost money. Vault withdrawals were re-enabled on 8 May at 2:00 PM after additional code reviews.

The patch was reviewed by Sec3 and two further third-party auditors, and Loopscale said its ongoing Sec3 engagement covers the full program library. Citing the sensitivity of the investigation, it declined to comment further. The attacker has not been identified.