On April 26, just two weeks after its launch, Loopscale was attacked, resulting in the theft of about 5.7 million USDC and 1,200 SOL. According to the platform, the reason was the exploitation of a vulnerability in one of the protocol’s markets. In response to the incident, the company contacted law enforcement and limited the project’s functionality for an investigation.
Loopscale explained that the error was related to the incorrect repricing of collateral through the RateX mechanism. Shortly after fixing the critical issue, the team restored loan payments, partially resuming the protocol.
Loopscale, formerly known as Bridgesplit, differs from other projects in that it uses an order book-based lending model, as opposed to more common pools such as Aave or Solend. The platform audit was conducted by OShield, which identified several serious issues that had already been resolved by the time of the incident. An additional audit by Sec3 is currently underway.
To encourage the return of the stolen funds, Loopscale offered a reward of 3947 SOL, which is about $594,000. On April 28, the hackers agreed to the proposed terms.
The Loopscale team expressed gratitude for the agreement reached, emphasizing that they are actively working on a friendly resolution to the situation. In the coming days, they plan to publish a detailed plan for resuming the withdrawal of funds and conduct a detailed analysis of the incident.
It is worth noting that similar cases have occurred before. For example, on April 23, an attacker who stole ZK tokens worth about $5 million from the ZKsync airdrop contract also returned the funds on time.