Safe

Aave

WETH

when

<p><a rel="noopener noreferrer nofollow" href="https://bitcoinworld.co.in">BitcoinWorld</a><br><img src="https://bitcoinworld.co.in/wp-content/uploads/feed-jpg/f-3fe0e874175c38fbc5253ac988443ce8.jpg" style="display: block; margin: 1em auto"><br><a rel="noopener noreferrer nofollow" href="https://bitcoinworld.co.in/aave-flashloopadapter-exploit-114-eth/">Third-party Aave adapter exploit drains 114 ETH from Safes</a></p>
<p>An attacker drained about 114.09 ETH — worth roughly $305,000 — from two Safe multisig wallets on Oct. 2 by exploiting an access-control flaw in a third-party adapter built on Aave v3, according to <a href="https://cryptoslate.com/crypto-hackers-exploit-third-party-aave-tool-to-steal-114-eth/" rel="noopener noreferrer nofollow">Cryptoslate</a>. Blockchain security firm SlowMist traced the loss to the FlashLoopAdapter, a module used to open and close leveraged Aave v3 positions through Safe wallets, while Aave’s own contracts were untouched.</p>
<div id="aeo-answer" class="aeo-answer-box"><strong>Aave v3’s core smart contracts were not affected.</strong> SlowMist said the attacker compromised two Safe multisig wallets through a flaw in the third-party FlashLoopAdapter, bypassing its authentication check to drain about 114.09 ETH, or roughly $305,000. Aave founder Stani Kulechov confirmed the incident involved external infrastructure built on top of Aave, not the protocol itself.
</div>
<p>Kulechov addressed the distinction directly, saying the affected code was not part of the protocol’s base layer. Cryptoslate reported him as saying the incident involved a third-party external adapter built on top of Aave rather than an Aave v3 contract, with no effect on the v3 codebase. For the largest decentralized lending protocol, which the report said holds more than $33 billion in total value locked, that separation is the central fact of the story.</p>
<h2 id="key-facts">Key facts</h2>
<ul>
 <li>SlowMist said the attacker compromised two Safe multisig wallets through a vulnerability in the FlashLoopAdapter used with Aave v3 positions.</li>
 <li>Direct loss was estimated at about 114.09 ETH, valued at roughly $305,000.</li>
 <li>Roughly 1,300 wrapped ETH (WETH) of debt was repaid during the attack to unlock collateral tied to the positions.</li>
 <li>SlowMist reported that the affected assets included weETH and other collateral associated with the two wallets’ Aave positions.</li>
 <li>Aave founder Stani Kulechov said the incident had zero effect on Aave v3’s core contracts.</li>
</ul>
<h2 id="the-authentication-bypass-at-the-centre-of-the-exploit">The authentication bypass at the centre of the exploit</h2>
<p>SlowMist attributed the vulnerability to the adapter’s open() and close() functions, which verified whether the calling Safe had enabled the adapter as a module. That check could be spoofed. The attacker created a fake Safe contract that always returned a positive response when asked whether the module was enabled, and the adapter accepted the forged authentication before proceeding to its internal swap function.</p>
<p>The more serious weakness followed. The adapter allowed the caller to specify both the router and the calldata used in an external contract call. According to SlowMist, the attacker pointed the router back at the victim Safe and supplied instructions invoking Safe’s execTransactionFromModule function. Because the FlashLoopAdapter was already enabled as a module on the affected wallets, that path let the attacker execute transactions through the victims’ Safes and withdraw the collateral.</p>
<p>Both outlets reported the same loss figure. Cointelegraph, which also covered the incident, said SlowMist’s estimate of about 114.09 ETH equated to roughly $305,000. The two reports are consistent on the amount, the number of wallets, and the adapter at fault. Cointelegraph additionally noted that SlowMist identified the vulnerable FlashLoopAdapter contract and the attacker’s wallet, and that the security firm did not report any losses to Aave v3 itself.</p>
<h2 id="why-it-matters">Why it matters</h2>
<p>The incident is a reminder that in decentralized finance, a protocol can remain secure on its own terms while the integrations layered around it open separate attack surfaces. Users of the FlashLoopAdapter carry that exposure, not Aave’s base contracts. The pattern has become familiar: an audited core protocol, an unaudited or lightly reviewed peripheral module, and a configuration mistake that turns a convenience tool into an entry point. For borrowers who rely on third-party position managers, the loss was real regardless of where the code lived on the stack.</p>
<h2 id="what-to-watch">What to watch</h2>
<p>The immediate question is how widely the vulnerable module was deployed — specifically, whether other wallets enabled the same adapter and whether its developers can identify additional affected positions before attackers reuse the authentication flaw. SlowMist’s disclosure named the vulnerable contract and the attacker’s wallet, which gives other integrators a starting point for checking their own exposure.</p>
<h2 id="frequently-asked-questions">Frequently Asked Questions</h2> Was Aave v3 itself hacked in this incident? 
<p>No. Aave founder Stani Kulechov stated that the exploit involved a third-party external adapter built on top of Aave, not Aave v3’s core smart contracts, and that the protocol itself had zero effect from the attack.</p> How much was stolen in the third-party Aave adapter exploit? 
<p>SlowMist estimated the direct loss at about 114.09 ETH, which both Cryptoslate and Cointelegraph valued at roughly $305,000. Roughly 1,300 WETH of debt was also repaid during the attack to unlock collateral tied to the positions.</p> How did the attacker bypass the wallet authorization check? 
<p>The attacker created a fake Safe contract that always returned a positive response when asked whether the module was enabled. The adapter accepted that forged authentication and then let the caller specify the router and calldata for an external contract call.</p> Which wallets and assets were affected? 
<p>Two Safe multisig wallets were compromised. SlowMist said the attacker used the technique to withdraw weETH and collateral associated with Aave positions from those wallets.</p> What should users of the FlashLoopAdapter do now? 
<p>Investigation is still underway. The open question is whether other wallets enabled the same module and whether the adapter’s developers will identify additional affected positions before attackers reuse the same authentication flaw.</p>
<p>This post <a rel="noopener noreferrer nofollow" href="https://bitcoinworld.co.in/aave-flashloopadapter-exploit-114-eth/">Third-party Aave adapter exploit drains 114 ETH from Safes</a> first appeared on <a rel="noopener noreferrer nofollow" href="https://bitcoinworld.co.in">BitcoinWorld</a>.</p>

Third-party Aave adapter exploit drains 114 ETH from Safes

Table of Contents

ItsBitcoinWorld

Other articles published on Oct 3, 2026

Judge Dismisses Amended LIBRA and M3M3 Complaint

Community banks sue OCC over crypto firms' national trust charters

NFT sales fall 23% to $40.9m as Panini jumps 557%

Bu Altcoin Kapanıyor: Fiyatı Bir Anda Çakıldı!

Two Crypto Stories Give Two Different Numbers for the Same Thing, a Third Does Not

Community Banks Sue OCC Over Crypto Trust Charters

Join our free newsletter for daily crypto updates!