FlashLoopAdapter exploit drains $305K from Aave-linked Safe wallets on Ethereum

An attacker exploited an access-control flaw in the third-party FlashLoopAdapter contract on October 1, 2026, draining approximately $305,000 from two Ethereum Safe wallets. The vulnerability allowed a fake Safe contract to bypass authentication checks. Using a Morpho flash loan, the attacker repaid 1,335 WETH of Aave debt to unlock and withdraw over 1,306 weETH in collateral, retaining a net profit of 114.09 ETH. Aave founder Stani Kulechov confirmed that the core Aave v3 protocol was unaffected.

FlashLoopAdapter exploit mechanics

• ▪An attacker exploited a custom contract called FlashLoopAdapter on Ethereum on October 1, 2026, draining approximately $305,000 from two Safe wallets.
• ▪The FlashLoopAdapter contract is a custom third-party Safe module designed to open and close leveraged looping positions through the Aave v3 protocol.

Access control vulnerability

• ▪The attacker manipulated the FlashLoopAdapter's _swap() function by supplying a custom swap router and calldata to invoke execTransactionFromModule on the victim Safe wallet.
• ▪The FlashLoopAdapter exploit was caused by an authentication flaw in the open() and close() functions, which checked if the module was enabled on the caller instead of verifying if the caller was a legitimate Safe.
• ▪The attacker bypassed FlashLoopAdapter's access controls by deploying a fake Safe contract programmed to return true when the adapter checked if the module was enabled.

Safe wallet losses

• ▪The two affected Safe wallets belonged to a single owner, and both wallets disabled the vulnerable FlashLoopAdapter module immediately following the attack.
• ▪The exploit resulted in a net loss of approximately 114.09 ETH, valued at roughly $305,000 to $310,000, which the attacker retained after settling the transaction costs.

Attack execution flow

• ▪Repaying the Aave debt freed up the leveraged collateral, allowing the attacker to withdraw approximately 1,306.48 weETH from the first Safe and 6.4 weETH from the second Safe.
• ▪The attacker utilized a Morpho flash loan to borrow WETH and repay approximately 1,335 WETH of Aave debt owed by the first victim Safe wallet.

Aave v3 protocol clarification

• ▪Aave founder Stani Kulechov and security firms confirmed that the core Aave v3 protocol and its lending contracts were unaffected by the FlashLoopAdapter exploit.
• ▪The FlashLoopAdapter exploit did not compromise Safe's core infrastructure, as the vulnerability resided entirely within the third-party adapter's caller-validation logic.

Third-party module security risks

• ▪The incident mirrors a September 15, 2026 exploit where an attacker drained approximately 2,900 rsETH from an Ethereum Safe wallet by targeting a weak authorization check in a custom module.
• ▪Similar Safe module exploits occurred in May 2026, including a $3 million exploit of the SquidRouterModule and an incident involving Gnosis Pay's Zodiac delay module.

Debatable claims

• ▪Core protocols bear responsibility for the security of third-party integrations
• ▪Multisig wallets should require manual owner approval for all module-executed transactions
• ▪DeFi users bear primary responsibility for the security of third-party wallet integrations
• ▪Custom Safe modules introduce unacceptable security risks to multisig wallets