Ethereum
FlashLoopAdapter Exploit Drains $305,000 in Ether From Safe Wallets
An access-control vulnerability in a third-party Aave V3 adapter enabled the theft of roughly 114 Ether from two Safe wallets.
An exploit targeting FlashLoopAdapter, a third-party contract used to manage leveraged positions on Aave V3, resulted in the theft of approximately 114.09 ETH valued at roughly $305,000. Blockchain security firm SlowMist reported that the attacker bypassed authentication checks across two Safe wallets belonging to the same owner before draining their collateral.
According to the security analysis, the vulnerability stemmed from the adapter's access-control mechanism, which verified module authorization through a check that could be spoofed with a fake Safe contract. The attacker exploited this flaw in a single transaction, using a Morpho WETH flash loan to settle debt and withdraw collateral, including wrapped staked ether (weETH) and Aave-held assets. The affected wallet owner subsequently disabled the module to prevent further unauthorized withdrawals.
Aave founder Stani Kulechov stated that core Aave V3 smart contracts were unaffected by the incident. On-chain monitoring revealed that the stolen funds were transferred to a single wallet before being moved in batches through the Tornado Cash mixer to obscure tracking.
These two are not the same thing, and one does not produce the other. The left is how this single article reads, from its tone alone. The right is the site’s own call on the asset, from indicators and analysis. Press tone feeds no score and no signal: on the only corpus this site has measured, daily tone tracked the move that had already happened and showed no measurable link with what followed.
More on Ethereum All pieces →
- Sell US Spot Ether ETFs Post Third Day of Outflows Totaling $118 Million
- Neutral US SEC Outlines New Crypto Custody Framework for Registered Asset Managers
- Neutral SEC Issues Draft Framework on Crypto Asset Custody for Regulated Funds
- Neutral Ethereum Glamsterdam Upgrade Scheduled for Sepolia Testnet Activation on October 6
Rewritten from the headline, the teaser and the one-line summary the qualification step produced — that is all the material there is, and nothing is added to it. The source link is kept on file so any item can be checked, and is not published here.
