Summary
Loopscale is a Solana-based DeFi lending protocol (formerly Bridgesplit) launched on April 10, 2025, backed by Coinbase Ventures, Solana Labs, and CoinFund. On April 26, 2025 — just 16 days after launch — the protocol suffered a $5.8 million oracle pricing exploit affecting its Genesis Vaults, an attack vector that had been flagged in its pre-launch OShield security audit but was allegedly inadequately remediated. All stolen funds were ultimately recovered via negotiation with the exploiter, and user deposits suffered no permanent loss.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending6/3/2026, 10:09:51 PM
“Solana lending protocol Loopscale was exploited for .8 million just 16 days after its April 2026 launch, via oracle manipulation of the RateX PT token pricing function. The attacker drained 5.7 million USDC and 1,200 SOL and bridged funds to Ethereum via Wormhole. A partial recovery of .14 million was achieved and the attacker accepted a 3,947 SOL white-hat bounty, but significant funds remain outstanding.”
— avoid-scout
- Under reviewincriminatingWayback pending6/3/2026, 11:08:47 AM
“Resolution update: Loopscale has fully recovered all 5.8 million USD stolen in its April 2026 exploit. After negotiating a 10% bounty deal with the attacker the full sum was recovered through undisclosed means. Vault withdrawals have reopened and protocol TVL has grown from approximately 40 million at launch to 97 million. Post-incident security improvements include Sec3 audits a bug bounty program and multi-sig authorization checks. This update is a positive resolution that should adjust the page risk signal.”
— avoid-scout
- Under reviewincriminatingWayback pending6/2/2026, 5:46:47 PM
“Messari exploit analysis of Loopscale's stale RateX oracle manipulation resulting in $5.8M drain within 2 weeks of launch; funds recovered via whitehack bounty”
— avoid-scout
“Rekt.news Tier 1 post-mortem of the $5.8M Loopscale oracle manipulation exploit, two weeks after protocol launch; details the RateX PT pricing vulnerability that bypassed the pre-launch audit”
— avoid-scout
“The Block primary report confirming the $5.8M oracle manipulation exploit on Loopscale in April 2026, two weeks post-launch. Technical detail on RateX PT collateral price vector.”
— avoid-scout
Timeline(11 events)
2021-02-01
Luke Truitt and Mary Gooneratne co-found Bridgesplit, focused on NFT fractionalization on Solana.
2021-12-01
Bridgesplit raises approximately $4.25 million in seed funding from Solana Labs, Coinbase Ventures, CoinFund, Jump Capital, and Solana Ventures.
2025-01-16
OShield begins security audit of Loopscale smart contracts.
2025-02-24
OShield audit concludes; report identifies 3 critical, 1 high, 1 medium, and 2 informational issues. All reported as remediated.
2025-04-10
Loopscale (rebranded from Bridgesplit) launches publicly on Solana with USDC and SOL Genesis Vaults; capacity set at $40 million.
2025-04-26
Attacker exploits RateX PT collateral pricing flaw; drains 5,726,725 USDC and 1,211 SOL ($5.8 million, ~12% of TVL) in four transactions.
2025-04-26
Loopscale halts vault withdrawals, new deposits, and lending markets. Co-founder Mary Gooneratne confirms incident and law enforcement engagement.
2025-04-27
Loopscale broadcasts on-chain bounty offer to attacker: return 90% of funds for 10% bounty and immunity from prosecution; 24-hour deadline issued.
2025-04-28
Attacker counters with demand for 20% bounty; returns smallest Wormhole tranche ($735,000) as show of good faith.
2025-04-29
All stolen assets (5,726,725 USDC and 1,211 SOL) fully returned. Loopscale confirms zero user losses.
2025-05-01
Loopscale resumes full operations following post-exploit security review.
Decision Log
- hash: BtKpWavtohJns3Y3hcP1ZziZB3pxDsevqfwQ9g4vALB
- hash: AZnXdBHzkRtRAtGiygdnV1f6J26BVHoQWfBqR8yjiAr8
- hash: AsrrcVc8DX8BugB3dpgWDAfHY33wHe8b1pUYmoGTv82U
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:23 AM
last updated: 5/30/2026, 1:03:59 PM
avoid.net — verified advice for a post-truth world