DeFi Platforms Loopscale, Term Finance Lose $7M in April Exploits

On April 26, the decentralized finance (DeFi) sector faced a significant setback as two prominent protocols, Loopscale and Term Finance, suffered exploits resulting in losses totaling over $7 million. These incidents have heightened concerns about the vulnerabilities of DeFi platforms in 2025.

Loopscale, a Solana-based platform, reported a major security breach impacting its USDC and SOL vaults. The exploit drained approximately $5.8 million, which represented roughly 12% of the platform’s total value. This attack occurred just two weeks after Loopscale’s official launch. The co-founder, Mary Gooneratne, confirmed that an attacker exploited the system by securing under-collateralized loans. Investigations revealed that the root cause stemmed from an isolated issue in the platform’s RateX-based collateral pricing system. However, Loopscale clarified that RateX itself was not compromised. “The root cause of the exploit has been identified as an isolated issue with Loopscale’s pricing of RateX-based collateral. There is no issue with RateX itself related to this. Loss of funds explicitly affects depositors to SOL and USDC genesis vaults,” Loopscale stated. Following the breach, Loopscale temporarily halted all markets to assess the damage. The platform has since resumed partial operations, enabling key functions like loan repayments, top-ups, and loop closures, while vault withdrawals remain restricted. To recover the stolen funds, Loopscale offered a 10% bounty to the attacker and proposed a whitehat agreement. The platform requested the return of 90% of the stolen assets and warned of legal action if the attacker did not respond by April 28. “We agree to allow you to retain a bounty of 10% of the funds (3,947 SOL) and release you from any and all liability regarding the attack,” Loopscale added. Loopscale is currently working with security firms and law enforcement agencies to manage the situation.

Meanwhile, Ethereum-based Term Finance, a pioneer in scalable fixed-rate lending, also reported a security incident on April 26. Blockchain security firm TenArmorAlert identified two suspicious transactions linked to Term Labs, resulting in losses of about $1.5 million. “It appears that something is wrong with the liquidation. Someone spent a very small amount of ETH to liquidate over 586 Treehouse collateral,” TenArmorAlert stated. Term Finance later confirmed that a faulty update to its tETH oracle caused the problem. Fortunately, no smart contracts were exploited, and the issue was contained within the tETH markets. The platform assured users that all other funds remain secure and has committed to a full reimbursement plan for those affected.

Ask Aime: "Was Loopscale's exploit a result of a smart contract issue or a human error?"

These attacks contribute to a worrying trend in 2025, with crypto projects losing close to $2 billion this year. High-profile incidents like Bybit’s $1.46 billion hack in February have shaken confidence across the industry. Tim Haldorsson, founder of Lunar Strategy, questioned whether DeFi returns justify the ongoing exploit risks. He suggested that DeFi yields might lag behind traditional investments like bonds once adjusted for hack-related losses. “How safe is actually all this defi? We are chasing yield, but hack-adjusted is it actually better than just holding bonds,” Haldorsson questioned.