{"investigation":{"slug":"loopscale","entity_name":"Loopscale","trust_score":38,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Loopscale is a Solana-based DeFi lending protocol (formerly Bridgesplit) launched on April 10, 2025, backed by Coinbase Ventures, Solana Labs, and CoinFund. On April 26, 2025 — just 16 days after launch — the protocol suffered a $5.8 million oracle pricing exploit affecting its Genesis Vaults, an attack vector that had been flagged in its pre-launch OShield security audit but was allegedly inadequately remediated. All stolen funds were ultimately recovered via negotiation with the exploiter, and user deposits suffered no permanent loss.","sections":[{"content":"Loopscale was founded in 2021 as Bridgesplit, originally focused on on-chain NFT fractionalization infrastructure on Solana. Co-founders Luke Truitt (CEO) and Mary Gooneratne (COO) later pivoted the product toward a modular fixed-rate lending order book, rebranding to Loopscale. The protocol raised approximately $4.25 million in seed funding from Solana Labs, Coinbase Ventures, CoinFund, Jump Capital, and Solana Ventures, with total funding reaching an estimated $8.25 million ahead of its April 2025 launch. Loopscale's model differs from algorithmic lending pools (e.g., Aave) by matching lenders and borrowers directly via an order book, enabling fixed interest rates and custom loan terms.","heading":"Protocol Background","sources":[{"url":"https://cryptorank.io/ico/bridgesplit","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://www.crunchbase.com/organization/loopscale","name":"crunchbase.com","type":"other","credibility":3},{"url":"https://www.rootdata.com/Projects/detail/Loopscale?k=MzE1NA%3D%3D","name":"rootdata.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On April 26, 2025, an unknown attacker drained approximately $5.8 million from Loopscale's USDC and SOL Genesis Vaults, representing roughly 12% of the protocol's total value locked at the time. The attack occurred only 16 days after the protocol's public launch on April 10, 2025. The exploit leveraged a flaw in Loopscale's internal pricing mechanism for RateX Principal Token (PT) collateral. By manipulating how the protocol valued RateX PT tokens, the attacker was able to take out undercollateralized loans — borrowing more than the actual value of their deposited collateral — and withdraw approximately 5,726,725 USDC and 1,211 SOL across four separate transactions. The stolen USDC was subsequently converted to SOL (totalling approximately 39,474.5 SOL across attacker wallets) and partially bridged to Ethereum via Wormhole in three transactions totalling approximately $5.165 million. Security researchers noted the attacker reverse-engineered Loopscale's functionality from its deployed binary, extracting the Interface Description Language and recreating internal operations locally — demonstrating that the protocol's closed-source code provided no meaningful security barrier.","heading":"The April 2025 Exploit","sources":[{"url":"https://www.theblock.co/post/352083/solana-defi-protocol-loopscale-hit-with-5-8-million-exploit-two-weeks-after-launch","name":"theblock.co","type":"other","credibility":3},{"url":"https://rekt.news/loopscale-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-loopscale-hack-april-2025","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=loopscale-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Loopscale's smart contracts were audited by OShield between January 16 and February 24, 2025. The audit identified three critical-severity issues, one high-severity issue, one medium-severity issue, and two informational issues. Critically, at least one identified issue concerned insufficient oracle validation: the audit specifically flagged that a malicious user could supply an oracle_account not present in the strategy's collateral map, allowing a custom account with manipulated pricing data to be injected. OShield's published report stated this issue was remediated by adding validation in the get_price() function against the oracle account stored in market_information. However, the April 26 exploit exploited precisely this category of vulnerability in the RateX PT collateral pricing logic — indicating the remediation was either incomplete or a related pricing flaw was not covered by the audit scope. A second audit by Sec3 was reportedly underway at the time of the exploit. The Genesis Vaults launched with a $40 million deposit capacity despite the audit history, which Rekt News described as suggesting premature confidence in the protocol's security posture.","heading":"Audit Failures and Pre-Launch Red Flags","sources":[{"url":"https://github.com/oshieldio/Publications/blob/main/Loopscale/loopscale-v1.md","name":"github.com","type":"other","credibility":3},{"url":"https://rekt.news/loopscale-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.vibraniumaudits.com/post/loopscale-exploited-for-5-8-million-just-two-weeks-after-launch","name":"vibraniumaudits.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/academy/article/loopscale-loses-dollar58-million-in-exploit-two-weeks-after-launch-halts-key-operations","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Immediately after detecting the exploit on April 26, Loopscale suspended vault withdrawals, new deposits, and lending market functions. Loan repayments, top-ups, and loop closures were subsequently re-enabled while the full investigation proceeded. Co-founder Mary Gooneratne publicly stated the team was 'fully mobilized to investigate and recover the stolen assets' and confirmed engagement with law enforcement. On April 27, Loopscale broadcast an on-chain message to the exploiter offering a formal whitehat agreement: return 90% of the stolen funds in exchange for a 10% bounty (approximately $580,000) and immunity from prosecution, with a 24-hour deadline. The exploiter countered, requesting a 20% bounty instead, and demonstrated alleged good faith by returning the smallest Wormhole-bridged tranche ($735,000) while retaining the larger amounts. The exploiter also indicated the largest bridged tranche 'is no longer their responsibility' — an ambiguous statement that created uncertainty about full recovery. By April 29, 2025, all stolen assets (5,726,725 USDC and 1,211 SOL) had been returned in full. Loopscale confirmed no user deposits suffered permanent loss. The final bounty amount paid to the exploiter was not publicly disclosed by the team; Rekt News noted Loopscale remained 'suspiciously silent' on this point.","heading":"Team Response and Fund Recovery","sources":[{"url":"https://invezz.com/news/2025/04/28/loopscale-hacker-accepts-bounty-offer-to-return-5-8-million-in-usdc-and-sol/","name":"invezz.com","type":"other","credibility":3},{"url":"https://crypto.news/hackers-behind-5-8m-loopscale-hack-agree-to-return-funds-in-exchange-for-10-bounty/","name":"crypto.news","type":"other","credibility":3},{"url":"https://blockchainreporter.net/loopscale-recovers-5-8m-after-exploit","name":"blockchainreporter.net","type":"other","credibility":3},{"url":"https://rekt.news/loopscale-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://coinmarketcap.com/academy/article/loopscale-loses-dollar58-million-in-exploit-two-weeks-after-launch-halts-key-operations","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The Loopscale incident illustrates several recurring risk patterns in DeFi. First, premature launch risk: the protocol went live with a $40 million vault capacity only weeks after its final audit, with a concurrent second audit still in progress at the time of the exploit. Second, audit-to-deploy gap: the OShield audit identified oracle-related vulnerabilities that were reported as fixed but were demonstrably insufficient to prevent a closely related attack vector. Third, closed-source security theater: the protocol's proprietary code was reverse-engineered by the attacker from the deployed binary within days, providing no meaningful security advantage. Fourth, oracle design risk: integrating third-party yield-bearing collateral (RateX PT tokens) without robust on-chain price validation introduces surface area that is notoriously difficult to audit comprehensively. Post-recovery, Loopscale resumed operations. As of early 2026, the protocol reported over $100 million in deposits and $38 million actively borrowed, suggesting continued user confidence following the incident, though the exploit remains a permanent part of the protocol's risk record.","heading":"Systemic Risk Factors","sources":[{"url":"https://rekt.news/loopscale-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.ainvest.com/news/solana-loopscale-suffers-5-8m-exploit-sparking-closed-source-debate-2504/","name":"ainvest.com","type":"other","credibility":3},{"url":"https://www.auditone.io/blog-posts/the-loopscale-incident-a-case-study-in-oracle-exploitation","name":"auditone.io","type":"other","credibility":3},{"url":"https://coincodecap.com/loopscale-review","name":"coincodecap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The Loopscale exploit occurred during a period of elevated DeFi security incidents. By Q1 2025, the crypto industry had reportedly lost approximately $1.6 billion to DeFi attacks. On the same weekend as the Loopscale exploit, Term Finance — another DeFi lending protocol — also suffered a separate hack, with combined losses from both incidents exceeding $7 million. The Loopscale case is frequently cited in post-mortems as a cautionary example of launching under-secured code against live capital too quickly, even when the protocol is backed by credible institutional investors. No regulatory action or law enforcement outcome related to the Loopscale exploit has been publicly disclosed as of the time of this investigation.","heading":"Broader DeFi Context","sources":[{"url":"https://beincrypto.com/hackers-steal-7-million-defi-protocols-loopscale-term-finance/","name":"beincrypto.com","type":"other","credibility":3},{"url":"https://coinchapter.com/hackers-drain-7-million-in-loopscale-hack-and-term-finance-hack-amid-defi-exploits-2025/","name":"coinchapter.com","type":"other","credibility":3},{"url":"https://www.nasdaq.com/articles/crypto-market-recap-loopscale-faces-us-58-million-hack-coinbase-preps-new-institutional","name":"nasdaq.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-02","event":"Luke Truitt and Mary Gooneratne co-found Bridgesplit, focused on NFT fractionalization on Solana.","source":"","date_original":"2021-02-01"},{"date":"2021-12","event":"Bridgesplit raises approximately $4.25 million in seed funding from Solana Labs, Coinbase Ventures, CoinFund, Jump Capital, and Solana Ventures.","source":"","date_original":"2021-12-01"},{"date":"2025-01-16","event":"OShield begins security audit of Loopscale smart contracts.","source":""},{"date":"2025-02-24","event":"OShield audit concludes; report identifies 3 critical, 1 high, 1 medium, and 2 informational issues. All reported as remediated.","source":""},{"date":"2025-04-10","event":"Loopscale (rebranded from Bridgesplit) launches publicly on Solana with USDC and SOL Genesis Vaults; capacity set at $40 million.","source":""},{"date":"2025-04-26","event":"Attacker exploits RateX PT collateral pricing flaw; drains 5,726,725 USDC and 1,211 SOL ($5.8 million, ~12% of TVL) in four transactions.","source":""},{"date":"2025-04-26","event":"Loopscale halts vault withdrawals, new deposits, and lending markets. Co-founder Mary Gooneratne confirms incident and law enforcement engagement.","source":""},{"date":"2025-04-27","event":"Loopscale broadcasts on-chain bounty offer to attacker: return 90% of funds for 10% bounty and immunity from prosecution; 24-hour deadline issued.","source":""},{"date":"2025-04-28","event":"Attacker counters with demand for 20% bounty; returns smallest Wormhole tranche ($735,000) as show of good faith.","source":""},{"date":"2025-04-29","event":"All stolen assets (5,726,725 USDC and 1,211 SOL) fully returned. Loopscale confirms zero user losses.","source":""},{"date":"2025-05","event":"Loopscale resumes full operations following post-exploit security review.","source":"","date_original":"2025-05-01"}],"sources_used":[{"url":"https://cryptorank.io/ico/bridgesplit","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260830032412/https://cryptorank.io/ico/bridgesplit","credibility":3,"archive_timestamp":"2026-08-30T03:24:12+00:00"},{"url":"https://www.crunchbase.com/organization/loopscale","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.rootdata.com/Projects/detail/Loopscale?k=MzE1NA%3D%3D","name":"rootdata.com","type":"other","archive_url":"http://web.archive.org/web/20260516142904/https://www.rootdata.com/Projects/detail/Loopscale?k=MzE1NA%3D%3D","credibility":3,"archive_timestamp":"2026-05-16T14:29:04+00:00"},{"url":"https://www.theblock.co/post/352083/solana-defi-protocol-loopscale-hit-with-5-8-million-exploit-two-weeks-after-launch","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260522154229/https://www.theblock.co/post/352083/solana-defi-protocol-loopscale-hit-with-5-8-million-exploit-two-weeks-after-launch","credibility":3,"archive_timestamp":"2026-05-22T15:42:29+00:00"},{"url":"https://rekt.news/loopscale-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260528034806/https://rekt.news/loopscale-rekt","credibility":3,"archive_timestamp":"2026-05-28T03:48:06+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-loopscale-hack-april-2025","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260317032508/https://www.halborn.com/blog/post/explained-the-loopscale-hack-april-2025","credibility":3,"archive_timestamp":"2026-03-17T03:25:08+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=loopscale-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260612081354/https://www.web3isgoinggreat.com/?id=loopscale-exploit","credibility":3,"archive_timestamp":"2026-06-12T08:13:54+00:00"},{"url":"https://github.com/oshieldio/Publications/blob/main/Loopscale/loopscale-v1.md","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20260528015540/https://github.com/oshieldio/Publications/blob/main/Loopscale/loopscale-v1.md","credibility":3,"archive_timestamp":"2026-05-28T01:55:40+00:00"},{"url":"https://www.vibraniumaudits.com/post/loopscale-exploited-for-5-8-million-just-two-weeks-after-launch","name":"vibraniumaudits.com","type":"other","archive_url":"http://web.archive.org/web/20260514074438/https://vibraniumaudits.com/post/loopscale-exploited-for-5-8-million-just-two-weeks-after-launch","credibility":3,"archive_timestamp":"2026-05-14T07:44:38+00:00"},{"url":"https://coinmarketcap.com/academy/article/loopscale-loses-dollar58-million-in-exploit-two-weeks-after-launch-halts-key-operations","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20251007030958/https://coinmarketcap.com/academy/article/loopscale-loses-dollar58-million-in-exploit-two-weeks-after-launch-halts-key-operations","credibility":3,"archive_timestamp":"2025-10-07T03:09:58+00:00"},{"url":"https://invezz.com/news/2025/04/28/loopscale-hacker-accepts-bounty-offer-to-return-5-8-million-in-usdc-and-sol/","name":"invezz.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.news/hackers-behind-5-8m-loopscale-hack-agree-to-return-funds-in-exchange-for-10-bounty/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20260516203133/https://crypto.news/hackers-behind-5-8m-loopscale-hack-agree-to-return-funds-in-exchange-for-10-bounty/","credibility":3,"archive_timestamp":"2026-05-16T20:31:33+00:00"},{"url":"https://blockchainreporter.net/loopscale-recovers-5-8m-after-exploit","name":"blockchainreporter.net","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.ainvest.com/news/solana-loopscale-suffers-5-8m-exploit-sparking-closed-source-debate-2504/","name":"ainvest.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.auditone.io/blog-posts/the-loopscale-incident-a-case-study-in-oracle-exploitation","name":"auditone.io","type":"other","archive_url":"http://web.archive.org/web/20260414065051/https://www.auditone.io/blog-posts/the-loopscale-incident-a-case-study-in-oracle-exploitation","credibility":3,"archive_timestamp":"2026-04-14T06:50:51+00:00"},{"url":"https://coincodecap.com/loopscale-review","name":"coincodecap.com","type":"other","archive_url":"http://web.archive.org/web/20260413105614/https://coincodecap.com/loopscale-review","credibility":3,"archive_timestamp":"2026-04-13T10:56:14+00:00"},{"url":"https://beincrypto.com/hackers-steal-7-million-defi-protocols-loopscale-term-finance/","name":"beincrypto.com","type":"other","archive_url":"http://web.archive.org/web/20251005231139/https://beincrypto.com/hackers-steal-7-million-defi-protocols-loopscale-term-finance/","credibility":3,"archive_timestamp":"2025-10-05T23:11:39+00:00"},{"url":"https://coinchapter.com/hackers-drain-7-million-in-loopscale-hack-and-term-finance-hack-amid-defi-exploits-2025/","name":"coinchapter.com","type":"other","archive_url":"http://web.archive.org/web/20260216213355/https://coinchapter.com/hackers-drain-7-million-in-loopscale-hack-and-term-finance-hack-amid-defi-exploits-2025/","credibility":3,"archive_timestamp":"2026-02-16T21:33:55+00:00"},{"url":"https://www.nasdaq.com/articles/crypto-market-recap-loopscale-faces-us-58-million-hack-coinbase-preps-new-institutional","name":"nasdaq.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:23.816033+00:00","updated_at":"2026-08-30T03:54:59.890974+00:00"}}