On October 1, 2026, an attacker compromised two Safe multisig wallets on the Ethereum network. The incident involved the exploitation of a third-party module known as FlashLoopAdapter, which is designed for managing leveraged positions on the Aave v3 protocol.
Security firms SlowMist and ExVul identified that the attacker forged Safe authentication to bypass access controls within the module. By deploying a fake contract, the exploiter successfully manipulated the module's open and close functions to move assets out of the wallets.
The attack was executed in a single transaction using a flash loan from Morpho. The perpetrator repaid between 1,300 and 1,335 WETH of Aave debt to release the collateral. The total losses for the victims are estimated between $305,000 and $310,000.
Following the repayment of the flash loan, the attacker secured a net profit of approximately 114.09 ETH. Both Aave v3 and the core Safe infrastructure remained secure, as the vulnerability was isolated to the third-party adapter's weak validation of caller inputs.
In response to the breach, the affected wallet owners disabled the FlashLoopAdapter module. Security experts emphasize that modules with broad execution rights can bypass standard multisig signature requirements, necessitating rigorous auditing of all third-party extensions.
