An attacker stole approximately 114.09 ETH from two Safe multisignature wallets by exploiting FlashLoopAdapter, a third-party module used to manage leveraged positions on Aave v3, SlowMist reported. The security firm’s incident database estimates the October 1 loss at about $305,000.
SlowMist later clarified that Aave v3’s contracts were unaffected, echoing Aave founder Stani Kulechov. The vulnerability was in an external adapter enabled by the affected wallets, rather than in the lending protocol itself.
🚨SlowMist TI Alert🚨
💸 @aave v3 Loop Safe Module Loss: ~114.09 ETH
🔍 Root Cause: FlashLoopAdapter's open()/close() access control only checks ISafe(msg.sender).isModuleEnabled(address(this)), which is spoofable via a fake Safe that always returns true. Its _swap() then…
— SlowMist (@SlowMist_Team) October 2, 2026
The adapter’s access check trusted the calling contract to confirm that the module was enabled. According to SlowMist, a counterfeit Safe that always returned an affirmative answer bypassed that check. Attacker-controlled transaction inputs then allowed the module to execute unauthorized transfers from the victims’ wallets.
SlowMist’s incident record says a Morpho flash loan supplied WETH to repay the victims’ Aave debt and release collateral. Roughly 1,300 WETH in debt was repaid before weETH collateral was drained. After settling the borrowed funds, the attacker retained around 114 ETH.
The case puts attention on the permissions granted to wallet extensions. CoinScreamer previously covered a separate Gnosis Pay exploit involving a Zodiac delay module attached to Safe wallets. Here, SlowMist identified the vulnerable component as FlashLoopAdapter, not Safe’s multisignature approval mechanism.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
