Blockchain security firm SlowMist has issued an alert after the Aave v3 Loop Safe module was exploited through an access-control vulnerability, draining approximately 114.09 ETH — around $305,000 — from two Safe multisignature wallets. The attack, detected on October 1 by Defimon Alerts, targeted the FlashLoopAdapter contract but left the core Aave v3 protocol untouched.

SlowMist TI Alert @aave v3 Loop Safe Module Loss: ~114.09 ETH Root Cause: FlashLoopAdapter's open()/close() access control only checks ISafe(msg.sender).isModuleEnabled(address(this)), which is spoofable via a fake Safe that always returns true. Its _swap() then… — SlowMist (@SlowMist_Team) October 2, 2026

FlashLoopAdapter is a Safe module built to automate the opening and closing of leveraged positions on Aave v3 — a looping strategy in which users repeatedly supply collateral and borrow against it to raise exposure. Safe modules are add-on contracts that extend a multisignature wallet's functionality with custom capabilities, such as automated position management. According to SlowMist, the root cause of the exploit lay in the access controls of the adapter's open() and close() functions. Rather than independently verifying the caller's identity, the functions merely checked that ISafe(msg.sender).isModuleEnabled(address(this)) returned true. An attacker could therefore deploy a fake Safe contract programmed to always return true, allowing a malicious caller to pass the verification check.

The attacker then abused the module's _swap() function, which executes a raw call to a caller-supplied router with fully attacker-controlled calldata. By setting the router to a victim Safe address and the calldata to execTransactionFromModule — a Safe function that lets an enabled module execute transactions — the attacker effectively turned the adapter's own permissions into a remote control over the victims' wallets. Because FlashLoopAdapter was already enabled as a module on both targeted Safes, the resulting calls were accepted without issue.

The attack chain went beyond simply draining available balances. The attacker took a WETH flash loan from Morpho — a type of uncollateralized loan that must be repaid within the same transaction — and used the borrowed funds to repay approximately 1,335 WETH of Aave debt belonging to the larger wallet, identified as 0xcfedf95a3653a128dfc2e4288758a1a1850d169f. Repaying the debt unlocked the leveraged position's collateral, after which the attacker had the Safe withdraw roughly 1,306 weETH, a liquid restaking token, to an attacker-controlled address.

A second Safe, 0xe3b23e47df7cd85876ac6cb05bdb9d7cd5b28520, lost an additional 6.4 weETH through the same mechanism. Defimon Alerts noted that both wallets shared the same single owner. After settling the flash loan and converting part of the withdrawn collateral to WETH, the attacker retained around 114.1 ETH. The attacker address was identified as 0x42c2633438609881cfBAb82414eb9A0c45F9353, while the vulnerable contract sits at 0x16bb8b912da187870c23ec6756bb3fad061283d8.

Aave v3 Core Unaffected, Echoing Earlier Safe Module Incidents

This is not Aave v3 contract, it's third party external adapter built on top of Aave, zero effect on Aave v3. — Stani (@StaniKulechov) October 2, 2026

In response to the incident, Aave founder and CEO Stani Kulechov clarified in a post that the exploited code was not part of Aave v3 itself but a third-party external adapter built on top of the protocol, with zero effect on the core contracts. Neither security alert identified any vulnerability in Aave v3, which continued to operate normally.

The exploit nonetheless highlights a recurring pattern in the Safe ecosystem. Because modules are granted the ability to execute transactions from a wallet without going through the standard owner approval flow, a single flaw in a module's authentication logic can expose all assets under its control — and because Safe multisignature wallets are a standard piece of DeFi infrastructure, commonly used to hold protocol treasuries and administrative controls, the security of each enabled module effectively becomes part of a wallet's own perimeter. A similar weakness surfaced in September, when an Ethereum Safe exploit involving roughly 2,900 rsETH was traced to inadequate authorization checks in an executor contract tied to an enabled module. In May, attackers drained approximately $3 million from 86 wallets by abusing the SquidRouterModule, and Gnosis Pay users were separately urged to withdraw funds after a flaw was found in its Zodiac delay module.