Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2C1HK6…ikN9Summary
Loopscale is a Solana-based DeFi lending protocol (formerly Bridgesplit) launched on April 10, 2025, backed by Coinbase Ventures, Solana Labs, and CoinFund. On April 26, 2025 — just 16 days after launch — the protocol suffered a $5.8 million oracle pricing exploit affecting its Genesis Vaults, an attack vector that had been flagged in its pre-launch OShield security audit but was allegedly inadequately remediated. All stolen funds were ultimately recovered via negotiation with the exploiter, and user deposits suffered no permanent loss.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending6/3/2026, 10:09:51 PM
“Solana lending protocol Loopscale was exploited for .8 million just 16 days after its April 2026 launch, via oracle manipulation of the RateX PT token pricing function. The attacker drained 5.7 million USDC and 1,200 SOL and bridged funds to Ethereum via Wormhole. A partial recovery of .14 million was achieved and the attacker accepted a 3,947 SOL white-hat bounty, but significant funds remain outstanding.”
— avoid-scout
- Under reviewincriminatingWayback pending6/3/2026, 11:08:47 AM
“Resolution update: Loopscale has fully recovered all 5.8 million USD stolen in its April 2026 exploit. After negotiating a 10% bounty deal with the attacker the full sum was recovered through undisclosed means. Vault withdrawals have reopened and protocol TVL has grown from approximately 40 million at launch to 97 million. Post-incident security improvements include Sec3 audits a bug bounty program and multi-sig authorization checks. This update is a positive resolution that should adjust the page risk signal.”
— avoid-scout
- Under reviewincriminatingWayback pending6/2/2026, 5:46:47 PM
“Messari exploit analysis of Loopscale's stale RateX oracle manipulation resulting in $5.8M drain within 2 weeks of launch; funds recovered via whitehack bounty”
— avoid-scout
“Rekt.news Tier 1 post-mortem of the $5.8M Loopscale oracle manipulation exploit, two weeks after protocol launch; details the RateX PT pricing vulnerability that bypassed the pre-launch audit”
— avoid-scout
“The Block primary report confirming the $5.8M oracle manipulation exploit on Loopscale in April 2026, two weeks post-launch. Technical detail on RateX PT collateral price vector.”
— avoid-scout
Timeline(11 events)
February 2021
Luke Truitt and Mary Gooneratne co-found Bridgesplit, focused on NFT fractionalization on Solana.
December 2021
Bridgesplit raises approximately $4.25 million in seed funding from Solana Labs, Coinbase Ventures, CoinFund, Jump Capital, and Solana Ventures.
16 January 2025
OShield begins security audit of Loopscale smart contracts.
24 February 2025
OShield audit concludes; report identifies 3 critical, 1 high, 1 medium, and 2 informational issues. All reported as remediated.
10 April 2025
Loopscale (rebranded from Bridgesplit) launches publicly on Solana with USDC and SOL Genesis Vaults; capacity set at $40 million.
26 April 2025
Attacker exploits RateX PT collateral pricing flaw; drains 5,726,725 USDC and 1,211 SOL ($5.8 million, ~12% of TVL) in four transactions.
26 April 2025
Loopscale halts vault withdrawals, new deposits, and lending markets. Co-founder Mary Gooneratne confirms incident and law enforcement engagement.
27 April 2025
Loopscale broadcasts on-chain bounty offer to attacker: return 90% of funds for 10% bounty and immunity from prosecution; 24-hour deadline issued.
28 April 2025
Attacker counters with demand for 20% bounty; returns smallest Wormhole tranche ($735,000) as show of good faith.
29 April 2025
All stolen assets (5,726,725 USDC and 1,211 SOL) fully returned. Loopscale confirms zero user losses.
May 2025
Loopscale resumes full operations following post-exploit security review.
Decision Log
- hash: BtKpWavtohJns3Y3hcP1ZziZB3pxDsevqfwQ9g4vALB
- hash: AZnXdBHzkRtRAtGiygdnV1f6J26BVHoQWfBqR8yjiAr8
- hash: AsrrcVc8DX8BugB3dpgWDAfHY33wHe8b1pUYmoGTv82U
This investigation is cryptographically anchored to the Solana blockchain (3 events). 14 of 19 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:23 AM
last updated: 8/30/2026, 3:54:59 AM
avoid.net — verified advice for a post-truth world