The aftermath of Loopscale—what’s more worth watching is “Who Can Repay.” A security incident has brought the true boundaries of lending products into the spotlight. ① Loopscale disclosed it had suffered a sustained attack and temporarily paused protocol activities. The team stated that affected vaults have been replenished and user deposits remain unaffected; however, this is a project disclosure—the full extent of losses and compensation details still require verification. ② Subsequent announcements confirmed partial functionality restoration: all loans can now add collateral, and repayments have been restored for all loans except those funded by the USDC Genesis Vault. Withdrawals from vaults and other functions remain restricted; this cannot be summarized as a full recovery. ③ For borrowers, whether they can timely add collateral and repay directly impacts liquidation risk. For depositors, what matters more is the status of funds in their specific vault, withdrawal permissions, and recovery conditions. ④ The project has disclosed two attack vectors: asset pricing configuration and vault net value manipulation. Further verification is still needed to confirm the scope of impact, validate fixes, and audit asset replenishment records. A simple claim of “funds are safe” is insufficient to determine whether similar risks have been fully eliminated. My personal view: Risk management in lending protocols should also include providing users with actionable ways to manage positions after an incident. I prioritize checking whether restored functions correspond to specific accounts and wait for public evidence to be fully disclosed before evaluating the effectiveness of the response. Vaults with restrictions must be cross-checked against the latest announcements to avoid mistaking partial restoration for full recovery. NFA / DYOR @Solana_zh @solana @Loopscale