SlowMist issued a security alert reporting that an Aave v3 Loop Safe module was exploited, with approximately 114.09 ETH stolen. The alert identifies the affected component as the Aave v3 Loo
SlowMist issued a security alert reporting that an Aave v3 Loop Safe module was exploited, with approximately 114.09 ETH stolen. The alert identifies the affected component as the Aave v3 Loop Safe module, a product integrating Aave v3 lending with Safe (formerly Gnosis Safe) smart account infrastructure.
WHAT TO KNOW
SlowMist, a blockchain security firm that previously flagged a FlashLoopAdapter flaw in Safe Wallet leading to collateral drain, issued the alert identifying the Aave v3 Loop Safe module as the entry point. The module combines Aave v3 looping strategies with Safe smart account custody, making it a high-value target at the intersection of two major DeFi primitives. For related coverage, see Bitget Hack: Where Did the Stolen $387M Go?.
The alert does not, in the supplied context, specify the exploit method, the attacker address, or whether the vulnerability has been patched. Verified on-chain transaction data confirming the 114.09 ETH drain was not included in the research brief, and independent block explorer confirmation was not available at time of writing.
The SlowMist security alert cites approximately 114.09 ETH as the stolen amount. No USD equivalent is calculable without a confirmed block timestamp and spot price at time of exploit; no such timestamp was provided in the alert context.
Aave v3, which has seen sustained protocol growth including its Monad market surpassing $100 million in deposits after launch, operates across multiple chains. The Loop Safe module affected in this incident targets leveraged yield strategies, where users loop borrowed assets to amplify exposure, a mechanism that concentrates capital and increases exploit surface area relative to a standard single-deposit position.
Aave's existing security posture includes a multi-platform bug bounty program; Aave Labs previously proposed splitting bug bounties across Immunefi, Sherlock, and Cantina to broaden coverage of exactly these kinds of integration-layer risks. Whether the Loop Safe module fell within active bounty scope at the time of this incident has not been confirmed.
The Aave v3 Loop Safe module integrates two separate protocol surfaces: Aave v3's lending pool and Safe's modular smart account system. An exploit at this integration layer differs from a core protocol vulnerability; it may be scoped to users who specifically deployed the Loop Safe module rather than all Aave v3 or Safe users.
This incident follows a pattern SlowMist has documented at the Aave-Safe integration layer. The earlier FlashLoopAdapter vulnerability in Safe Wallet also involved collateral drain via a loop-style adapter, suggesting the attack surface at this interface warrants continued scrutiny. For comparison, the scale here, at approximately 114.09 ETH, is substantially smaller than the $387 million Bitget hack, though the architectural exposure it represents may carry broader implications for integrated DeFi modules.
Technical root cause, affected user scope, and remediation steps are not confirmed in the available alert context. Users of Aave v3 looping strategies via Safe accounts should monitor official communications from Aave, Safe, and SlowMist directly for verified next steps and any contract pause or migration notices.
Additional source references: source document 1.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
Read original article on marketbit.net
