A security exploit targeting a third-party Aave v3 Loop Safe module drained approximately 114.09 ETH on October 1, 2026. Blockchain data confirms a precise transfer of 114.096151469674448809 ETH, valued at $308,696.27 at the time of transfer. The incident occurred on the Ethereum network. Blockchain security firm SlowMist issued the alert, identifying the vulnerable component as FlashLoopAdapter, a custom Safe module built around Aave V3's lending infrastructure. Safe modules are opt-in extensions that, once enabled, gain permission to execute transactions on a multisig wallet's behalf — a design that leaves fund security dependent on each module's own authorization code.

What SlowMist Reported

SlowMist's security alert attributed the flaw to authorization logic in FlashLoopAdapter's open() and close() functions, which relied on ISafe(msg.sender).isModuleEnabled(address(this)) to verify callers. In a genuine Safe configuration, that function checks the wallet's own on-chain record of enabled modules; when the caller supplies a counterfeit implementation of the interface, the response reflects the attacker's claim rather than the wallet's actual state. According to the alert, that check can be spoofed by a contract that implements the ISafe interface without being a genuine Safe deployment, allowing an attacker to impersonate the wallet and trigger unauthorized fund movements.

Two Safe multisig wallets were affected, according to a report by The Crypto Times published on October 2, 2026. The on-chain transaction, recorded at 15:08:47 UTC, withdrew 1,306.4823 weETH from Aave and repaid 1,335.2558 WETH to Aave: Ethereum WETH V3, with the net ETH proceeds routed to an address Etherscan labels "Aave V3 Loop Exploiter 1."

Reported Loss: Approximately 114.09 ETH

SlowMist's alert placed the total loss at approximately 114.09 ETH — about $308,700 at the time of transfer — a figure consistent with the gross transfer amount visible in the confirmed Ethereum transaction. Key details from the on-chain record:

On-chain data

• Transaction: 0x75328f…616fc4
• Amount transferred: 114.096151469674448809 ETH ($308,696.27 at the time of transfer)
• Recipient: an address Etherscan labels "Aave V3 Loop Exploiter 1"
• weETH withdrawn: 1,306.4823 weETH from Aave
• WETH repaid: 1,335.2558 WETH to Aave: Ethereum WETH V3
• Timestamp: October 1, 2026, 15:08:47 UTC

Scope: What the Alert Identifies, and What It Does Not Yet Confirm

SlowMist's alert names the FlashLoopAdapter module as the attack surface and does not claim that Aave V3 core lending pools were compromised. The exploit targeted wallet-level module logic, not Aave's supply and borrow contracts. A full post-mortem has not been published as of this report, and the total number of affected wallets beyond the two identified has not been confirmed.

Aave founder Stani Kulechov drew a clear scope boundary in a public statement on X dated October 2, 2026, shortly after the alert. The distinction has direct implications for the broader DeFi trust model Kulechov has articulated, including his arguments about how DeFi protocols should be evaluated against their peripheral integrations.

This is not Aave v3 contract, it's third party external adapter built on top of Aave, zero effect on Aave v3.

— Stani (@StaniKulechov) via X, October 2, 2026

Why Module-Level Security Matters in DeFi Lending Setups

Component risk can differ materially from core-protocol risk. Safe multisig wallets support modular extensions that with DeFi protocols, creating a layer of custom logic between user funds and audited contract code. FlashLoopAdapter operated in that intermediate layer, using Aave V3 as a liquidity backend while managing looped position entry and exit through its own authorization model. As Aave Labs expands its protocol surface, including a tokenized-asset credit market on Avalanche, module-level audit discipline becomes increasingly relevant for any integration that inherits Aave's trust reputation without undergoing equivalent scrutiny.

The weETH and WETH collateral cycle visible in the transaction data is consistent with leveraged restaking strategies that use loop adapters to amplify yield on liquid staking tokens. Loop adapters automate a supply-borrow-resupply cycle to build leveraged exposure on a collateral asset — a pattern that matches the paired withdrawal and repayment visible in the transaction record. Users running similar setups through third-party adapters should verify whether their module authorization paths can be spoofed by a contract that merely implements the ISafe interface rather than being a genuine Safe deployment.

What Users and Integrators Should Monitor

For integrators building on top of Aave V3 with custom Safe modules, the primary check is whether authorization logic validates the calling context against a trusted registry rather than relying on msg.sender self-attestation. SlowMist's identification of the spoofable isModuleEnabled check points to an authorization pattern that can surface wherever Safe modules delegate trust to the caller's own reported state. Protocol monitoring tools and wallet-level audit reviews remain the recommended actions while the full scope of the incident is investigated. The observable items going forward are the full SlowMist post-mortem, confirmation of whether any wallets beyond the two identified were affected, and on-chain movement of the 114.09 ETH credited to the labeled exploiter address.