FlashLoopAdapter (Aave v3 loop Safe module) hack — October 2026

Two Safe multisig wallets that used FlashLoopAdapter, a third-party Safe module for opening and closing leveraged loop positions on Aave v3, lost about 114.1 ETH, roughly $306,700, on 1 October 2026. The attack was a single Ethereum transaction at 15:08:47 UTC in block 26,098,264, and Defimon Alerts flagged it ten seconds later. Aave itself was not exploited: its founder Stani Kulechov said the contract was a third-party adapter built on top of Aave with no effect on Aave v3. Who built the adapter and who controls the two wallets has not been disclosed.

According to SlowMist, the adapter's open() and close() functions checked only that the calling contract reported the adapter as one of its enabled Safe modules, a question a fake Safe can simply answer yes to. The adapter's internal swap step then called a router address with calldata, both supplied by the caller. The attacker deployed a fake Safe, set the router to a victim's Safe and the calldata to execTransactionFromModule, and because the adapter was an enabled module on the victims' wallets, the Safes carried out whatever it passed them. To free the collateral, the attacker flash-borrowed WETH from Morpho, repaid about 1,335 WETH of the victims' Aave debt, withdrew their weETH collateral and repaid the flash loan in the same transaction.

The gross flows were far larger than the loss. What the attacker kept was the difference between the 1,449.35 WETH its contract received from the swaps and the 1,335.26 WETH it paid into Aave: 114.10 WETH, which this registry read from the transaction's logs and which matches SlowMist's figure of 114.09 ETH. The amount recorded here values it at the ether price of that hour. No recovery, bounty offer or statement from the adapter's developers has been reported.