Crypto02 October, 20262 min read
Attacker Exploits FlashLoopAdapter, Drains $305K From Two Aave V3 Safe Multisig Wallets
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Exploited FlashLoopAdapter drained ~114 ETH ($305k) from two Safe multisig wallets. Third-party adapter flaw drained funds; Aave V3 core contracts unaffected.
FlashLoopAdapter drains Safe wallets
An attacker exploited FlashLoopAdapter, a third-party Ethereum module managing leveraged Aave V3 positions through Safe wallets, and drained about $305,000 from two Safe multisig wallets on October 1. Defimon estimated losses at approximately $305,000 after attackers targeted two affected wallets on October 1, while Etherscan showed approximately $3.88 million in gross collateral movement for the first transaction. SlowMist said the attack targeted a module used to open and close leveraged Aave v3 positions through Safe wallets, and the attacker exploited an access-control flaw that allowed a fake Safe contract to pass the adapter’s authorization check.
The attacker repaid about 1,335 WETH in Aave debt before withdrawing about 1,306 weETH in collateral from the first wallet, and a second wallet lost about 6.4 weETH. Aave founder Stani Kulechov said the incident did not affect Aave V3’s core contracts, and he described it as a third-party external adapter built on top of Aave.
How the exploit worked
SlowMist said the attacker exploited an access-control flaw that allowed a fake Safe contract to pass the adapter’s authorization check, and the adapter also allowed the caller to control the router and transaction data used for swaps. The attacker used that functionality to execute transactions through the victim Safes and drain weETH and collateral, and around 1,300 wrapped Ether (WETH) in debt was repaid during the attack to unlock collateral. The attacker bypassed a contract check and unlocked the wallets’ collateral, leading to the loss, and the attacker used a Morpho WETH flash loan to repay debt and unlock collateral held by the affected wallets.
The attacker drained around 114.09 ETH, worth roughly $305,000 to $310,000, and the stolen funds were moved toward Tornado Cash. The breach didn’t touch Aave’s core lending contracts at all, and the vulnerability lived entirely inside the custom adapter contract that Safe wallet users had opted into.
Market and security stakes
AAVE traded around $181.06, recording an 8.49% daily increase and a 27.60% weekly gain, and AAVE’s market capitalization reached approximately $2.79 billion with a daily trading volume exceeding $640 million. AAVE trades above all four major daily exponential moving averages, and a 20-day EMA at $150.27 and a 50-day EMA at $132.91 were cited as part of its bullish technical structure. The FlashLoopAdapter incident introduced fresh concerns about third-party tools connected to Aave’s lending ecosystem, even as it described the technical picture as strong.
SlowMist identified the vulnerable FlashLoopAdapter contract and the attacker’s wallet but did not report any losses to Aave v3 itself, while Stani Kulechov stated the incident did not involve the core Aave V3 contracts. The incident unfolded on October 1 when an attacker-controlled contract managed to slip past the access checks built into FlashLoopAdapter, and the investigation remains open about whether other wallets or contracts tied to the module were affected beyond the two reported so far.