$305K Lost in FlashLoopAdapter Exploit

A custom Ethereum module called FlashLoopAdapter was exploited on October 1, resulting in an estimated loss of about $305,000. The attack targeted two Safe wallets that had enabled the FlashLoopAdapter module to manage their leveraged Aave V3 positions.

The exploit relied on an access-control flaw in the FlashLoopAdapter contract, not a weakness in Aave's core lending contracts. An attacker was able to pass the module's access checks and use its execution path to interact with the two Safe wallets.

Once inside, the attacker repaid about 1,335 WETH of Aave debt and withdrew about 1,306.48 weETH from one of the Safe wallets. The second wallet lost around 6.4 weETH in the same incident. After the withdrawal, the attacker converted part of the assets and kept about 114.1 ETH.