Aave Hackers Swipe $300,000 in Ether via Third-Party Tool Exploit

Crypto hackers have exploited a third-party Aave tool to steal over $300,000 in Ether. The exploit targeted an external infrastructure layered on Aave, which remained unaffected. This incident highlights concerns about risks beyond core protocol contracts.

SlowMist investigators revealed that the attacker compromised two Safe multisig wallets through a flaw in the FlashLoopAdapter used with Aave v3 positions. The vulnerability allowed the attacker to bypass authentication checks and drain collateral from the affected wallets.

The direct loss was estimated at about 114.09 ETH, while roughly 1,300 WETH of debt was repaid during the attack to unlock collateral tied to the positions. Aave founder Stani Kulechov confirmed that this incident did not involve Aave v3's core smart contracts.

The exploit affected infrastructure layered on top of Aave, which has over $33 billion in total value locked. The vulnerability was traced to the FlashLoopAdapter's open() and close() functions, which checked whether the calling Safe had enabled the adapter as a module.