Safe

Aave

Ravencoin

Summit

<p><strong>A flaw in a third-party integration called FlashLoopAdapter allowed an attacker to drain collateral from two Safe multisig wallets, blockchain security firm SlowMist reported. The vulnerability did not originate in Safe itself, but in an external adapter connected to the Aave ecosystem.</strong></p>
<h2 id="slowmist-flags-flashloopadapter-as-the-weak-link">SlowMist flags FlashLoopAdapter as the weak link</h2>
<p>SlowMist identified FlashLoopAdapter as the source of the exploit. The component is a third-party adapter, entirely separate from the Safe multisig wallet protocol. That distinction matters: the core Safe contracts were not compromised. The flaw lived one layer out, in code plugged into Safe from outside. For related coverage, see <a href="https://www.theccpress.com/is-ravencoin-still-worth-buying-with-btc-in-2026/" rel="noopener noreferrer nofollow">Is Ravencoin Still Worth Buying with BTC in 2026?</a>.</p>
<p>According to <a href="https://cryptoslate.com/crypto-hackers-exploit-third-party-aave-tool-to-steal-114-eth/" rel="noopener noreferrer nofollow">reporting by CryptoSlate</a>, the attacker exploited how FlashLoopAdapter handled collateral during flash loan sequences, ultimately walking away with 114 ETH from two targeted wallets. SlowMist, which has a consistent track record tracing exploits back to peripheral integrations, flagged the incident and attributed the root cause to the adapter’s logic, not Aave or Safe directly. For related coverage, see <a href="https://www.theccpress.com/traders-fair-uzbekistan-2026-a-new-chapter-for-central-asia-s-trading-community-begins-in-tashkent/" rel="noopener noreferrer nofollow">Traders Fair Uzbekistan 2026: A New Chapter for Central Asia’s Trading Community Begins in Tashkent</a>.</p>
<p>This is not the first time the firm has traced a significant loss to an adjacent vulnerability. SlowMist previously documented a separate case involving the <a href="https://www.theccpress.com/slowmist-liquid-network-exploit-3998-l-btc/" rel="noopener noreferrer nofollow">Liquid Network exploit that minted 3,998 L-BTC</a>, where the attack vector similarly bypassed a core protocol’s defenses through a peripheral component. For related coverage, see <a href="https://www.theccpress.com/fintech-revolution-summit-thailand-2026/" rel="noopener noreferrer nofollow">Fintech Revolution Summit –Thailand 2026</a>.</p>
<h2 id="reported-impact-collateral-drained-from-two-safe-wallets">Reported impact: collateral drained from two Safe wallets</h2>
<p>The reported target count is two Safe multisig wallets. What was taken was collateral, not a full wallet balance sweep. That framing from SlowMist is specific: collateral locked in positions accessible through FlashLoopAdapter was what the attacker could reach.</p>
<p>CryptoSlate’s coverage puts the confirmed figure at 114 ETH stolen via the third-party Aave tool. Whether additional wallets had authorized FlashLoopAdapter but escaped the attack is not confirmed in available reporting.</p>
<h2 id="why-third-party-integrations-expand-multisig-risk">Why third-party integrations expand multisig risk</h2>
<p>Safe wallets are widely regarded as among the most secure custody setups in DeFi. But security is only as strong as the weakest integration point. When users authorize third-party adapters to interact with their wallets, those adapters inherit execution privileges. A flaw in the adapter’s logic can be weaponized even when the wallet itself behaves exactly as designed.</p>
<p>The FlashLoopAdapter case fits that pattern precisely: a trusted outer layer with a flaw in something plugged into it. Anyone using Safe wallets alongside automated DeFi strategies, including those built around the <a href="https://www.theccpress.com/blockcon-global-confirms-2026-speaker-roster-investors-igaming-operators-and-the-web3-infraestructure/" rel="noopener noreferrer nofollow">broader Web3 infrastructure ecosystem</a> being discussed at major industry events, now has a concrete reminder that adapter authorization is not a low-stakes decision.</p>
<p>SlowMist has not publicly detailed remediation steps based on available information, and it is not confirmed whether the affected wallets have been made whole. The attacker’s identity remains unknown from publicly available reporting.</p>
<p>How many more wallets authorized FlashLoopAdapter before this flaw was caught? That number, if it surfaces, will define the true blast radius of this exploit.</p>
<p>Additional source references: <a href="https://www.deepl.com" rel="noopener noreferrer nofollow">source document 1</a>.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px;">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p>
<p>The article <a href="https://www.theccpress.com/?p=48778" rel="noopener noreferrer nofollow">SlowMist Reports FlashLoopAdapter Flaw Drained Two Safe Wallets</a> first featured on <a href="https://theccpress.com/" rel="noopener noreferrer nofollow">theccpress.com</a>.</p>

SlowMist Reports FlashLoopAdapter Flaw Drained Two Safe Wallets

Table of Contents

Cryptocurrency Press

Other articles published on Oct 3, 2026

Join our free newsletter for daily crypto updates!