Loopscale said on Nov. 7 that deposits and withdrawals had resumed across all vaults, alongside “full loan management functionality,” reopening the Solana lending protocol after an attack-related pause.
Vault withdrawals had been restricted since at least its Nov. 5 pause announcement, roughly two and a half days before Saturday's reopening update.
The restoration includes the USDC Genesis Vault. In the partial reopening previously reported by The Defiant, borrowers funded by that vault remained unable to repay loans or withdraw collateral. Other borrowers could repay and reclaim collateral after full repayment, and collateral top-ups were available for all loans, but withdrawals from all vaults remained frozen.
https://x.com/i/status/2119183228011422122
Loopscale's vaults pool a single asset and lend it across borrowing markets. The USDC Genesis Vault's public interface showed about $7 million supplied. Restored access does not mean unlimited immediate withdrawals: the protocol's documentation says withdrawals remain subject to available liquidity.
Loss Accounting and Security Details Pending
Loopscale said in its initial pause statement that the affected SOL and USDC Genesis vaults had been made whole and no user deposits had incurred a loss.
In its subsequent account of the incident, the team said it had identified and contained two attack paths involving program logic and private transaction-building APIs. It attributed an undercollateralized loan of approximately $412,000 from the SOL Genesis Vault to pricing parameters that valued deposited collateral as a different asset.
For the USDC Genesis Vault, Loopscale said a bundle of transactions sold a loan carrying an extreme interest rate into the vault, inflating its net asset value and enabling a disproportionate redemption of approximately $521,000. The team said its systems halted that activity within 30 seconds of transaction generation.
Loopscale had tied a return to normal operations to establishing the campaign's full scope and implementing further security hardening. Its reopening statement did not detail those changes or provide a final loss-and-recovery accounting. It promised a full technical post-mortem “soon,” without setting a publication date.