Aave-Linked Exploit Drains $305K From Safe Wallets on Ethereum

A security exploit linked to Aave's V3 protocol has drained $305,000 from two Safe wallets on Ethereum. The attacker bypassed a contract check using a fake Safe and exploited a weakness in FlashLoopAdapter, a third-party contract that manages leveraged positions on Aave V3.

The hacker used a Morpho WETH flash loan to repay debt and unlock collateral held by the affected wallets, ultimately draining around 114.09 ETH worth $305,000 to $310,000. The transaction withdrew approximately 1,306 weETH from one wallet, but this figure reflects gross movement, not the attacker's final gain.

Aave founder Stani Kulechov stated that the attack did not affect Aave V3's core contracts, emphasizing that it was a third-party external adapter issue. The stolen funds were moved to a central address and later sent in batches toward Tornado Cash, a non-custodial privacy mixer.