Did the v4.0 testnet get hit by a similar Lopp attack just a few days ago?
1. No, but few days ago, there was just a regular testnet3 blockstorm. To trigger it, all that is needed, is mining every 2016th block, with the minimal difficulty. Any CPU miner can trigger that kind of attack. And if no ASIC will find a block in 20 minutes, then it will happen automatically.
2. Testnet4 is resistant to that. There is some discussion about "7200 seconds rule vs 600 seconds rule", but it is about timewarp attacks. Blockstorms are already fixed.
I'm not seeing anything exchange side for those deposits.
Of course, addresses assigned to users are different. For example:
https://mempool.space/testnet/tx/69564bc22744b4cf78c348d25b23017f7e9c63ca2f01070fbc8d288402912efcYour code can sweep it, but it is never assigned to any user's account. Which means, that miners cannot "mine on exchange's address", but they have to use their own addresses, accumulate coins, and then do a separate transaction for deposit.