SlowMist: Aave v3 Loop Safe Module Exploit Steals 114 ETH

Blockchain security firm SlowMist issued an alert reporting that the Aave v3 Loop Safe Module was exploited, with approximately 114.09 ETH stolen in the incident. The alert identifies the affected component by name and flags the theft as an active security event for Aave protocol users and DeFi participants monitoring on-chain risk.

SlowMist Alert: What Happened to Aave v3’s Loop Safe Module

SlowMist, which operates as an on-chain threat intelligence and smart contract auditing firm, named the Aave v3 Loop Safe Module as the exploited component. The Loop Safe Module is an auxiliary layer built on top of Aave v3’s core lending infrastructure, designed to facilitate looped leverage positions within a defined safety boundary. Its compromise is distinct from a breach of Aave’s core protocol contracts. For related coverage, see BlockCon Global Confirms 2026 Speaker Roster: Investors, iGaming Operators and the Web3 Infrastructure.

The alert does not confirm the exploit method or identify the attacker, and those details remain unverified at the time of publication. Users interacting with loop-based strategies on Aave v3 should treat any unconfirmed remediation steps circulating on social channels with caution until an official post-mortem is released by the relevant development team.

DeFi module exploits of this type share a structural pattern with the ResolvLabs USR suspected exploit flagged by on-chain analysts, where auxiliary or wrapper contracts built atop base protocols become the attack surface rather than the underlying protocol itself.

Approximately 114.09 ETH Stolen: Security Implications for DeFi Users

The reported loss stands at approximately 114.09 ETH. No USD equivalent was confirmed in SlowMist’s alert, and current Ethereum market data was unavailable at publication time, so a dollar conversion is not included here to avoid unsupported figures.

Aave v3’s core lending pools were not confirmed as affected. The distinction matters for users holding collateral or debt positions directly within the main Aave v3 markets, as opposed to those using loop or leverage modules layered on top. Users with active positions in any Aave v3 loop product should verify their exposure against official Aave governance or security communications.

Incidents like the $42 million GMX exploit on Arbitrum and the $27 million BigONE exchange hack illustrate that smart contract security failures frequently originate outside core protocol logic, in modules, wrappers, or off-chain integrations that interact with audited base contracts. The BigONE hot wallet exploit similarly demonstrated how peripheral components carry independent attack surfaces that may not receive equivalent audit scrutiny.

From a decentralized protocol security standpoint, the incident highlights a recurring gap in composability risk assessment: auxiliary modules often inherit implied trust from the audited protocol they wrap. On-chain AI agent infrastructure and automated DeFi strategies that programmatically interact with loop modules face compounded exposure when those modules are compromised mid-execution, since automated position management cannot self-interrupt without explicit circuit-breaker logic.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.