Two Safe Wallets Lose $305,000 in FlashLoopAdapter Attack

A custom FlashLoopAdapter used to manage leveraged Aave V3 positions was exploited in a hack on Ethereum, leaving two Safe wallets with an estimated net loss of 114.09 ETH, or about $305,000.

The attacker spoofed a Safe authentication check, then used a Morpho WETH flash loan to repay debt and unlock collateral. The roughly 1,306 weETH withdrawn from one wallet was a gross transaction flow, not the attacker's net proceeds.

Defimon Alerts said it detected the Ethereum attack at 15:08:57 UTC on Thursday, October 1. SlowMist published its analysis on Friday, October 2, identifying a weakness in the adapter's open and close functions. A malicious contract could pose as a Safe and return that value, passing a check intended to confirm that a legitimate wallet had enabled FlashLoopAdapter.

The AAVE hack attacker-controlled contract also supplied the adapter's swap router and calldata. It pointed the router at a victim Safe and set the calldata to invoke execTransactionFromModule. Because FlashLoopAdapter was already enabled on that Safe, the wallet accepted the call as an authorized module transaction.

The sequence turned a narrow authentication flaw into access to wallet-controlled collateral. The episode underscores how wallet permissions and execution paths matter alongside the security of the lending protocol itself, a concern also central to custody infrastructure and authentication controls.