SlowMist Alert: Aave v3 Loop Safe Module Exploit Drains 114.09 ETH

Blockchain security firm SlowMist has issued a security alert reporting that the Aave v3 Loop Safe Module was exploited, with approximately 114.09 ETH stolen. The alert names the specific module involved and the approximate loss figure, though no further technical details about the attack method, affected users, or remediation steps were included in the published notice.

KEY POINTS

• SlowMist issued a security alert flagging an exploit targeting the Aave v3 Loop Safe Module.
• The reported loss is approximately 114.09 ETH.
• The alert does not specify the attack vector, affected wallet addresses, or attacker identity.

SlowMist Reports Aave v3 Loop Safe Module Exploit

According to SlowMist's security alert, the Aave v3 Loop Safe Module was targeted in an exploit that resulted in the theft of approximately 114.09 ETH. SlowMist, a blockchain security firm known for tracking on-chain incidents, attributed both the affected component and the loss figure in its notice. This follows a previously reported FlashLoopAdapter flaw that drained Safe wallet collateral, suggesting a pattern of vulnerabilities in loop-based DeFi integrations. For related coverage, see MIT Brothers to Face Trial over MEV Bot Exploit.

The alert names the Aave v3 Loop Safe Module specifically, a component that enables leveraged looping strategies using Aave v3 liquidity in conjunction with Safe multisig wallets. Aave v3 remains one of the largest DeFi lending protocols by activity, tracked across the Ethereum ecosystem on DeFiLlama. Beyond identifying the module and the approximate ETH loss, the supplied alert excerpt does not include a technical breakdown of how the exploit was executed.

What Is Known About the Reported 114.09 ETH Loss

The available information confirms only what SlowMist stated: approximately 114.09 ETH was stolen from the Aave v3 Loop Safe Module. The alert does not specify the attack vector, affected user addresses, the attacker's identity, or whether any remediation or pause has been applied to the module.

No on-chain transaction hash was included in SlowMist's published alert excerpt, so independent verification of the approximately 114.09 ETH figure against a specific Ethereum transaction record has not been possible from the available source material. Protocol activity for Aave across wallets can be referenced on DeBank's Aave protocol page for those monitoring positions.

SlowMist has previously tracked significant DeFi losses, including in its report covering $147 million in Web3 losses for July 2025, underscoring the firm's consistent role in incident monitoring. Exploits targeting composable DeFi modules, such as the MEV wallet exploit that prompted a Coinbase response, have repeatedly demonstrated that integrations between protocols can introduce non-obvious risk surfaces.

For Southeast Asian DeFi participants on platforms that integrate Aave v3 strategies, including services accessible via regional exchanges, the incident is a reminder to verify active positions in any loop or leverage module until official guidance is available. Users and protocols should consult official channels from both the Aave and Safe teams for verified technical updates as this report develops. For broader context on DeFi exploit patterns, the CrediX exploit case illustrates how quickly protocol incidents can escalate without transparent communication from development teams.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.