Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
ETH SlowMist issued a security warning: Aave v3 Loop Safe module was attacked.
Blockchain security company SlowMist issued an alert stating that Aave v3 Loop Safe module was used and approximately 114.09 ETH was stolen. This incident further confirms the increasingly frequent pattern of decentralized finance (DeFi) module-level vulnerabilities, and security researchers have issued warnings about such risks many times in 2026.
SlowMist has previously documented incidents including phishing activities that cost platform users more than $1 million and the risk of tampering with cold wallets. This alert clearly lists Aave v3 's Loop Safe module as the target, not the Aave v3 core protocol itself. This distinction is critical for assessing the extent of exposure.
The Loop Safe module is a peripheral component that extends the functionality of Aave v3, not the core loan contract. SlowMist's alert describes the incident as an actual exploit in progress, rather than a theoretical vulnerability disclosure.
~114.09 ETH stolen
SlowMist reported that~114.09 ETH was stolen in this attack. The company used the qualifier "approximately" to indicate that the loss amount may be adjusted as on-chain analysis continues. No fiat currency conversion data is provided in the alert, and as of the release of this report, the confirmation information of the hash value of a specific transaction by the independent blockchain has not been disclosed.
In terms of scale, this incident is at the midstream level of a DeFi attack. For reference, the Resupply protocol theft through interest rate manipulation, and SlowMist's warning of price manipulation in the Cork protocol demonstrate the various attack vectors currently active in lending and revenue infrastructure.
Information to be confirmed
SlowMist's alerts did not include information such as the identity of the attacker, the specific exploitation mechanism, whether the affected funds were recoverable, or the remedial measures taken by the Aave team. Users with positions interacting with the Loop Safe module should pay close attention to the official Aave Governance Forum and SlowMist's Security Channel for updated guidance.
This is not the first time SlowMist has flagged a security vulnerability related to modular DeFi extensions. The company's analysis of Cetus protocol attacks that affect the SUI ecosystem also points out that the peripheral modules are the attack surface, not the core protocol contracts. This pattern suggests that security audits of composable add-ons should be subject to the same level of review as base-layer code.
