$305,000 Leaves Two Ethereum Safes Through an Add-On Aave Never Shipped
The add-on made one Safe repay its own debt, then withdraw its collateral to a stranger. Aave v3 was never touched.
Two Safe wallets on Ethereum lost about $305,000 on October 1 to an access-control exploit in FlashLoopAdapter, the loop module for Aave v3, per Defimon Alerts’ account on X[1].
Per Defimon Alerts, the attacker used a Morpho WETH flash loan to repay one Safe’s 1,335 WETH Aave debt, then had that Safe withdraw 1,306 weETH of collateral to the attacker; a second Safe gave up 6.4 weETH, and the attacker kept 114.1 ETH[2].
Defimon Alerts said the adapter is a custom contract built on top of Aave and that the incident did not affect Aave v3 itself[3].
What to do: no action needed on Aave v3 itself — Defimon Alerts said the custom contract built on top of Aave was the one affected, not Aave v3[3].
Who gains, who loses
Receipts
A FlashLoopAdapter access-control exploit on Ethereum drained approximately $305,000 from two Safe wallets on October 1.
“🚨 FlashLoopAdapter (@aave v3 loop Safe module) - Loss $305K (2026-10-01) Network: Ethereum Type: Access Control”
The FlashLoopAdapter attacker used a Morpho WETH flash loan, withdrew 1,306 weETH from one Safe and 6.4 weETH from a second Safe, and retained 114.1 ETH.
“Using a Morpho WETH flash loan, the attacker repaid Safe 0xcfed…'s 1,335 WETH Aave debt, then had the Safe withdraw 1,306 weETH of collateral to the attacker.”
Defimon Alerts said the FlashLoopAdapter incident affected a custom adapter built on Aave and did not affect Aave v3 itself.
“The adapter is a custom contract built on top of Aave.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.