Loopscale Pauses Protocol After kySOL Collateral Was Priced as zBTC in a 4,597 SOL Loan

Loopscale's Genesis Vault lent 4,597 SOL against a single kySOL token that the protocol valued as ten zBTC. The decimal mismatch behind it is the most instructive part of the incident, and a second attack path shows how far the probing went. One token worth roughly $120 was all a Loopscale vault held when it handed out 4,597 SOL, because the protocol read that token as ten Bitcoin-denominated coins.

The arithmetic behind the mistake is simple. A One-Token Loan Worth 4,597 SOL Loopscale, a Solana lending protocol built around Genesis Vaults, paused operations on November 5 after a week of what it called a sustained campaign by a sophisticated actor. Its APIs were taking more than 30,000 malicious requests a day.

Loopscale's pause announcement, as summarized on CoinMarketCap, says user deposits remain secure and affected vaults were restored. The team has not named the suspected attacker. The loan itself can be traced onchain.

A November 1 transaction shows a wallet Loopscale identified drawing 4,597 SOL after depositing one kySOL, a restaked SOL token. The collateral deposit paired kySOL with a zBTC asset identifier, which backs up Loopscale's account that the collateral was valued as a different asset. How a $120 Token Became Ten zBTC An independent researcher's trace found that the attacker bought one kySOL for about 1.

31 SOL and deposited it into Loopscale roughly 154 seconds later. The protocol priced it as ten zBTC. At the loan's implied SOL price, that kySOL was worth somewhere near $120, while ten zBTC would be worth about ten Bitcoin.

The numbers line up with a decimal mismatch. On Solana, each token's mint account stores its own decimal precision, as Solana's documentation on tokens explains. kySOL uses nine decimals, like SOL, while a Bitcoin-denominated token such as zBTC uses eight.

One kySOL is 1,000,000,000 base units, and read at eight decimals, that same raw balance comes out to 10. 0. The protocol never had to be fooled about the price of Bitcoin.

It only had to read one token's raw amount on another token's decimal scale. That arithmetic explains the reported valuation, but it is not a root-cause statement from Loopscale. The team's own description is broader: a misconfigured combination of asset-pricing parameters caused collateral to be valued as a different asset.

The result was an undercollateralized loan of about $412,000. Why the Label Was Allowed to Disagree With the Mint The harder question is how the protocol accepted a mismatch at all. According to the researcher's analysis, the attacker picked a price entry for zBTC, labeled the collateral as an Orca position and deposited kySOL.

Under the Orca collateral rule, the kySOL mint was allowed to differ from the zBTC identifier. Labeling it as a standard SPL token would have failed, since that rule demands the mint and identifier match. That detail matters more than the decimals.

Each rule looked sensible by itself, and the flaw lived in the combination: a price source, a collateral type label and a mint check that together let one token be priced as another. It also explains why Loopscale pointed to both its publicly inspectable program logic and its private transaction-building APIs. Thirty thousand requests a day reads like systematic probing for a combination the normal API would build or authorize.

The Second Path: A Redemption Stopped in 30 Seconds Loopscale's November 6 update named two attack paths. The second went after the USDC Genesis Vault. Per the protocol, an atomic transaction bundle sold a loan carrying an extreme interest rate into the vault, inflating its net asset value and setting up a disproportionate redemption of about $521,000.

Loopscale says its systems halted that redemption within 30 seconds of the transaction being generated. So the incident ended in two different outcomes. The SOL path produced a real undercollateralized loan, while the USDC path was an attempt the team says it stopped.

Counting both as stolen would overstate the damage, and Loopscale maintains that depositors took no loss and that affected vaults were made whole. What the Published Addresses and Transactions Show Loopscale linked four addresses in its disclosure. The two Solana addresses are 247Lk5YNH9URfBBvxVUtDruz8GvGX8gKGuYHVCZThpiR and AzPh2dUV3duK9n8PWV6CxKMwWr9Rk7fxPNBZuv1CiwMr.

The two EVM addresses are 0xb8959Aca4e4C796A3BaDA66833eAe60b1BC0bfb2 and 0xB7Ec7eF24FD73f3000C651CA9D0Fa45b61DcF854. Reports indicate the borrowed SOL was bridged out of the protocol, which fits the pairing of Solana and EVM addresses. The loan's later history is visible onchain as well.

A November 3 liquidation of the same loan moved about 4,598. 4 SOL from a separate wallet back to the lending strategy. The researcher's trace puts the figure at 4,598.

434180621 wSOL against 4,597 SOL borrowed, a gap of roughly 1. 43 SOL. The liquidator received the lone kySOL as collateral.

The public record doesn't yet show who funded that liquidation, so Loopscale's post-mortem will need to explain how the vault was made whole. Lessons for Lending Protocols Built on API-Assembled Transactions The takeaways are narrow and practical. Decimal scales should come from the token's own mint data rather than a configured identifier, and a deposit should fail when the collateral's mint doesn't match the asset the pricing path assumes.

Private transaction-building APIs deserve the same scrutiny as onchain code, because an attacker who can probe them tens of thousands of times a day can map out which combinations they will build. Vault accounting needs limits too. An extreme interest rate that is legal in the program can still reprice a share if the vault treats the loan mark as authoritative, which is why the 30-second halt on the second path counted for so much.

This looks less like a clever exploit than a missing sanity check. A deposit worth about $120 should never support a 4,597 SOL loan, and a simple ceiling on collateral value against the borrower's deposited units would have flagged it. Loopscale also lost $5.

8 million in April 2025 to a pricing flaw before recovering the funds, so the next thing to watch is whether its post-mortem shows pricing safeguards that match how often this class of bug has shown up. Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.

Follow us on X @nulltxnews