FlashLoopAdapter exploit drains $305K from two Aave-linked Safe wallets

On October 1 2026, an attacker exploited a third-party FlashLoopAdapter module flaw to drain two Ethereum Safe multisig wallets. The attacker forged Safe authentication to bypass the module's access controls, used a Morpho flash loan to repay roughly 1,335 WETH of Aave debt, then withdrew around 1,306 weETH in collateral. Combined losses are estimated at $305K to $310K, with the attacker netting roughly 114.09 ETH. Neither Aave v3 nor Safe core infrastructure was compromised, and both affected wallets disabled the vulnerable module immediately after the attack.

Key points

1. A third-party FlashLoopAdapter module flaw allowed an attacker to drain two Safe multisig wallets on Ethereum.
2. The attacker forged Safe authentication to bypass the module's access controls.
3. Neither Aave v3 nor Safe core infrastructure was compromised in the attack.
4. The attacker's net profit from the exploit was approximately 114.09 ETH.

Why it matters

Price context · AAVE

Sources · 6 publishers

Coverage timeline

1. Oct 2, 03:34First reported by Crypto Briefing
2. Oct 2, 05:59Also reported by Crypto.news
3. Oct 2, 06:04CryptoVideos brief published
4. Oct 2, 07:23–09:335 more publishers added to sources