Aave-Linked Exploit Drains $305K From Safe Wallets via FlashLoopAdapter Weakness
Aave-linked Exploit Drains $305K in ETH From Safe Wallets
On October 2, 2026, a FlashLoopAdapter exploit drained about 114.09 ETH (worth roughly $305,000-$310,000) from two Safe wallets on Ethereum.
The hacker exploited a weakness in the third-party contract that manages leveraged positions on Aave V3 by spoofing a Safe access check, using a Morpho WETH flash loan to repay debt and unlock collateral held by the affected wallets.
Aave founder Stani Kulechov stated that the attack did not affect Aave V3's core contracts or liquidity pools.