Web3 Daily Exploits — 6 Nov 2026: Loopscale Contained Attempts, FLOKI Bot Offline

The 6 Nov America/Panama window records no first-reported protocol incidents with confirmed scored user losses. Loopscale, a Solana order-book lending protocol, paused activity on 5 November after a week-long campaign of more than 30,000 malicious API requests per day targeting its SOL and USDC Genesis Vaults. The team identified two attack paths: a misconfigured asset-pricing parameter set that enabled an undercollateralized loan of approximately $412K from the SOL Genesis Vault, and an atomic bundle that sold a high-interest-rate loan into the USDC Genesis Vault to inflate NAV and enable a disproportionate redemption of approximately $521K, which systems halted within 30 seconds. Affected vaults were made whole and no user deposits incurred a loss. Priority loan functions have been partially restored; vault withdrawals remain restricted. Separately, FLOKI announced an exploit in its Telegram trading bot discovered early on 5 November, took the bot offline, and is migrating affected users to new wallets while advising against deposits and private-key exports. No loss figure has been disclosed. TENDRIL’s prior BNB Chain sell-hook drain remains an UPDATE. Combined live scored loss on this card is ~$0.

Loopscale — Solana — contained ~$933K attempts — pricing mismatch + NAV inflation

What happened: Beginning around late October into early November 2026, Loopscale’s APIs received sustained malicious traffic exceeding 30,000 requests daily. On 5 November the team detected escalation and paused protocol activity. Two paths were later identified: (1) misconfigured asset-pricing parameters caused deposited collateral (example: 1 kySOL paired with a zBTC identifier) to be valued as a different asset, enabling an undercollateralized loan of ~$412K (reports cite ~4,597 SOL) from the SOL Genesis Vault; a subsequent liquidation returned approximately the same SOL amount. (2) An atomic transaction bundle sold a loan carrying an extreme interest rate into the USDC Genesis Vault, inflating its NAV and enabling a disproportionate redemption of ~$521K; the system halted the redemption within 30 seconds of transaction generation. Loopscale states affected vaults were made whole and no user deposits will incur a loss. Four addresses were published (two Solana, two EVM-format). Priority collateral top-ups, repayments (except USDC Genesis-funded loans), and collateral withdrawals for fully repaid loans have been restored; vault withdrawals and other functions remain restricted.

Protocol / chain / asset: Loopscale modular order-book lending protocol on Solana. Affected: SOL Genesis Vault and USDC Genesis Vault. Assets: SOL, USDC, related collateral tokens (kySOL, zBTC identifiers noted in path analysis).

Loss: No user deposits incurred a loss per Loopscale. Attempted impact reported as ~$412K undercollateralized loan and ~$521K NAV-inflated redemption (halted). Vaults made whole by the team. Live scored figure: $0 user loss. Protocol TVL remained in the ~$88M range on DefiLlama around the incident.

Attack type: Pricing-parameter misconfiguration enabling collateral valuation mismatch (undercollateralized borrow) combined with atomic bundle NAV inflation via high-interest loan sale into a vault. API-layer probing campaign preceded the on-chain paths. Contained by pause and internal halt; no open-ended drain confirmed.

Explorer URLs: Loopscale official statement and update: https://x.com/Loopscale/status/2118285556123611378, https://x.com/Loopscale/status/2118502123705159769. Identified addresses: 247Lk5YNH9URfBBvxVUtDruz8GvGX8gKGuYHVCZThpiR, AzPh2dUV3duK9n8PWV6CxKMwWr9Rk7fxPNBZuv1CiwMr (Solana); 0xb8959Aca4e4C796A3BaDA66833eAe60b1BC0bfb2, 0xB7Ec7eF24FD73f3000C651CA9D0Fa45b61DcF854 (EVM). Specific transaction hashes for the two paths were not published in the primary statements at cutoff.

Status: Confirmed by Loopscale official posts. Vaults made whole, no user loss. Partial functionality restored; full restoration pending further hardening. Engaged with federal law enforcement. Flag any subsequent loss figure or incomplete recovery as material update. Similar pricing issues occurred in Loopscale’s April 2025 incident (~$5.8M, fully recovered).

Sources: Loopscale: https://x.com/Loopscale/status/2118285556123611378, https://x.com/Loopscale/status/2118502123705159769; DefiLlama; Solana Compass; CryptoBriefing.

FLOKI Telegram trading bot — unknown chain — loss undisclosed — bot wallet exploit

What happened: Early on 5 November 2026 the FLOKI team announced it had discovered an exploit in its Telegram trading bot. The bot was taken offline. The team is identifying affected users, moving remaining funds to new secure wallets, and advising users not to deposit into bot wallets. Users who exported private keys are told to move any remaining funds to wallets they solely control. Unsolicited “refund/recovery” messages are to be ignored. No on-chain transaction set or loss amount has been published.

Protocol / chain / asset: FLOKI Telegram trading bot (utility product associated with the FLOKI token). Chain(s) not specified in the announcement; bot wallets historically interact with multiple networks. Asset: user funds held in bot-controlled or exported-key wallets.

Loss: Undisclosed at cutoff. No figure from FLOKI, DefimonAlerts, CertiKAlert or other monitored sources. Live scored: not assigned. Token price reacted (reports of ~5–7% decline) but that is not a protocol loss figure.

Attack type: Unspecified exploit affecting the trading bot, resulting in risk to bot wallets and exported private keys. Official statement focuses on containment and user migration rather than root-cause detail.

Explorer URLs: None published in primary announcements. Official post: https://x.com/FLOKI/status/2118381080260608281.

Status: Confirmed by FLOKI official statement. Bot offline, investigation ongoing, affected users to be migrated. Loss size unknown; treat any later quantified drain as material update. Flag unverified third-party claims of specific amounts until confirmed.

Sources: FLOKI: https://x.com/FLOKI/status/2118381080260608281; The Defiant; SlowMist Zone listing.

Also noted

• TENDRIL sell-hook (UPDATE, not re-scored): Incident first reported 4–5 November. ~$555K USDT drained from PancakeSwap V2 pair on BNB Chain via premature burn/sync. Phalcon later noted most profit may have come from pre-attack V3 liquidity rather than the hook alone. No material new loss figures. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-05-nov-2026-tendril-555k-sell-hook/.
• CoreVault / Mercado Bitcoin / Binance (UPDATE, not re-scored): Prior incidents with no material new scored loss in the last 24 hours.
• Monitored accounts: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi and rekt.news. No additional first-report protocol drains with fresh confirmed user-loss figures beyond the contained Loopscale paths and undisclosed FLOKI bot item.

Sources and references

• Loopscale initial: https://x.com/Loopscale/status/2118285556123611378
• Loopscale update with path details: https://x.com/Loopscale/status/2118502123705159769
• FLOKI bot announcement: https://x.com/FLOKI/status/2118381080260608281
• The Defiant FLOKI coverage: https://thedefiant.io/news/security/floki-takes-trading-bot-offline-amid-exploit-investigation
• 5 Nov brief for TENDRIL: https://www.rektradar.xyz/web3-daily-exploits-05-nov-2026-tendril-555k-sell-hook/
• Monitored accounts checked: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, rekt.news. No additional first-report protocol exploits with fresh scored user-loss figures in the last 24 hours.

Editor’s note: the scored live loss on this card is ~$0. Loopscale paths were contained with vaults made whole and no user deposits lost. FLOKI bot loss remains undisclosed. TENDRIL is an UPDATE. No how-to or exploit reproduction steps. Stay tuned or stay rekt.