SlowMist: Aave v3 Loop Safe Module Exploited, About 114.09 ETH Stolen

SlowMist has issued a security alert saying the Aave v3 "Loop Safe Module" was exploited, resulting in the theft of roughly 114.09 ETH. The firm characterized the incident as an active onchain security event for Aave users and DeFi participants tracking protocol risk. SlowMist, an onchain threat-intelligence and smart-contract auditing firm, said the compromised component was the Loop Safe Module. The module sits on top of Aave v3's core lending system and is designed to support looped leverage positions within a defined safety framework. SlowMist's note indicates the issue is separate from any confirmed breach of Aave's core protocol contracts. The alert did not specify how the exploit was carried out or identify an attacker. Those details remained unverified at the time of publication. Users engaging in loop-based strategies on Aave v3 are advised to be cautious about unverified "fixes" circulating on social media until the relevant development team publishes an official postmortem. The incident reflects a broader DeFi risk pattern in which auxiliary or wrapper contracts built on top of base protocols become the primary attack surface, rather than the underlying protocol itself. Similar dynamics have been noted in other recent incidents flagged by onchain analysts. Losses were reported at approximately 114.09 ETH. SlowMist did not provide a USD figure, and no reliable ETH price reference was confirmed at publication time; a dollar estimate is omitted to avoid unsupported numbers. There was no confirmation that Aave v3's core lending pools were affected, a distinction that matters for users with collateral or debt positions in the main Aave v3 markets versus those using loop or leverage modules layered above them. Users with exposure to any Aave v3 loop products are encouraged to verify their status through official Aave governance or security communications. Recent events such as the $42 million GMX exploit on Arbitrum and the $27 million BigONE exchange hack underscore that security failures often originate in peripheral modules, wrappers, or integrations that interact with audited base contracts. From a protocol-security perspective, the episode also highlights a recurring composability blind spot: auxiliary modules can inherit implied trust from the protocols they wrap, even when their risk profile differs. Automated DeFi strategies and onchain AI agent infrastructure that programmatically interact with loop modules may face heightened exposure if a module is compromised mid-execution, particularly when automation lacks explicit circuit-breaker controls. Disclaimer: This content is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets involve significant risk. Conduct your own research before making decisions.