FlashLoopAdapter Exploit Drains $300K from Safe Wallets via Access-Control Flaw

A custom Ethereum module called FlashLoopAdapter was exploited on October 1, 2026, draining over $300,000 from two Safe wallets. The attacker used a WETH flash loan from Morpho to carry out the attack, repaying roughly 1,335 WETH in Aave debt and then withdrawing about 1,306.48 weETH from one wallet and 6.4 weETH from another.

The vulnerability was an access-control flaw in FlashLoopAdapter itself, not in Aave's underlying lending protocol. This distinction is crucial because the attack did not touch Aave's core contracts at all, but rather targeted a custom module used for managing leveraged positions.

The incident highlights the importance of secure coding practices and regular security audits, especially for modules and add-ons built on top of popular DeFi protocols like Aave. As more users rely on these tools to manage their leverage, it's essential that they understand the risks associated with custom modules and take steps to mitigate them.