SECURITY ALERT
The lending market held. The add-on did not.
An attacker appears to have drained about 114.09 ETH (roughly $305,000) from two Safe multisig wallets on Ethereum on 1 Oct 2026 in the FlashLoopAdapter exploit, abusing a third-party Aave v3 leverage-loop module, according to an alert from security firm SlowMist.
The exploit transaction was mined at about 15:08 UTC on 1 Oct. SlowMist’s alert followed at about 03:00 UTC on 2 Oct.
How the FlashLoopAdapter exploit worked
A Safe “module” is an add-on contract that a wallet’s owners allow to move funds without collecting fresh signatures each time.
FlashLoopAdapter opened and closed leveraged Aave positions for Safes that enabled it. SlowMist says the adapter’s open() and close() functions only asked the caller whether the adapter was an enabled module.
A fake Safe can answer yes to anything.
Its swap step also let the caller choose the “router” and its calldata, SlowMist says. The attacker pointed it at the victim Safes and called execTransactionFromModule.
The Safes held leveraged weETH, a liquid restaking token.
A flash loan, borrowed and repaid inside one transaction, came from Morpho and repaid about 1,300 WETH of Aave debt, unlocking that collateral. The net loss was far smaller: about 114.09 ETH, SlowMist says.
Aave v3’s core contracts were not affected, SlowMist clarified.
Evidence ledger
Attacker: 0x42c2633438609881c8fBAb82414eb9A0c45F9353
Victim Safe 1: 0xe3b23e47df7cd85876ac6cb05bdb9d7cd5b28520
Victim Safe 2: 0xcfedf95a3653a128dfc2e4288758a1a1850d169f
Vulnerable module: 0x16bb8b912da187870c23ec6756bb3fad061283d8
Exploit tx: 0x75328f916b1a0878724d364da5eb12b255160b894cb36c63ed5d718efc616fc4 (Etherscan)
Post by @SlowMist_Team on X: https://x.com/SlowMist_Team/status/2105855276536725599
Who built the module, how many other Safes enabled it, and whether any ether can be recovered is not yet public.
What to do now
Protect yourself
- In the Safe app, open Settings → Modules. If
0x16bb…83d8is listed, disable it.- Ordinary Aave positions held in a Safe without this module are not affected, according to SlowMist.
- Treat every enabled module as a second set of keys. Remove the ones you no longer use.
Corrections and new evidence: [email protected]
This article was written by Dalia Haddadin, an AI author persona at CryptoWatchDesk, and was reviewed, fact-checked and edited by Akriti Seth. It is not investment advice. Dalia Haddadin holds no crypto assets.