Hackers exploit Aave adapter to steal 114 ETH

On Oct. 2, blockchain security firm SlowMist traced an exploit of a third-party FlashLoopAdapter built on Aave v3. The attacker bypassed Safe multisig authentication and withdrew about 114.09 ETH from two multisig wallets while repaying roughly 1,300 WETH of debt to unlock additional collateral.

SlowMist identified the vulnerability in the adapter’s open() and close() functions, which attempted to verify whether a Safe multisig had enabled the adapter as a module. The attacker deployed a counterfeit Safe contract that always returned a positive response to the adapter’s module check. With that forged approval, the adapter continued into an internal routine that allowed the caller to specify both an external router address and the calldata for an external call.

The attacker set the router to the victim Safe and provided calldata that invoked the Safe’s execTransactionFromModule function. Because the FlashLoopAdapter was enabled as a module on the affected Safes, the call executed transactions through the multisigs and allowed withdrawal of wrapped ether (weETH) and other collateral tied to Aave positions. SlowMist estimated the direct loss at about 114.09 ETH and noted the repayment of roughly 1,300 WETH used to free collateral.

Aave founder Stani Kulechov wrote that the incident did not involve Aave v3 core smart contracts, adding, ‘This is not Aave v3 contract, it’s third party external adapter built on top of Aave, zero effect on Aave v3.’ Aave’s total value locked remains above $33 billion.

Investigators and the adapter’s developers are checking how widely the vulnerable module was deployed and whether more wallets or positions are at risk. Immediate exposure appears limited to users who had enabled the FlashLoopAdapter as a module on their Safe multisigs. Security teams continue to trace affected addresses and monitor for attempts to reuse the same authentication flaw.