SlowMist flagged it first, and the numbers were almost insulting in their modesty. 114 ETH. Roughly $300,000. Two Safe multisigs drained. And the headline that ran everywhere โ "Aave exploited" โ is wrong in a way that matters more than the loss itself.
I've watched this movie before. Not the hack. The aftermath. The reflexive blame aimed at the biggest name in the frame, while the actual point of failure โ a third-party adapter nobody stress-tested โ quietly disappears from the conversation. Aave v3's core contracts never blinked. The protocol's $33 billion in TVL didn't flinch. What broke was the thing bolted on top of it, a wrapper contract that asked a question it had no business trusting the answer to.
Volatility isn't the story here. Trust delegation is. A "helper" contract queried an untrusted caller for its credentials, believed the reply, and relayed a privileged call with genuine credentials attached.
Let me walk the actual attack chain. Because if you run any automated looping strategy โ and in 2026, a lot of you do โ this is your problem too.
Here's the architecture, stripped of jargon. Aave v3 is the lending base layer โ the biggest decentralized money market in existence, north of $33 billion in total value locked. Safe is the multisig infrastructure most serious capital sits behind; when whales and DAOs custody funds on-chain, Safe is usually where those funds live. Between those two layers lives a category of tooling people barely think about: adapters.
FlashLoopAdapter was one of them. A third-party contract that automated "loop" strategies for Safe wallets. The loop works like this: deposit collateral, borrow against it, swap the borrowed asset back into collateral, redeposit, repeat. Each cycle stacks leverage and stacks yield. Done manually it's tedious and gas-hungry. Done by an adapter, it's one click.
The victims were running a specific flavor: weETH as collateral, WETH borrowed, recycled. weETH is Ether.fi's restaking receipt โ an asset that itself carries layered risk. Restaking derivative plus leveraged loop. That combination was already fragile before any hacker appeared. It bleeds when restaking yield compresses. It bleeds harder when weETH depegs. The adapter just stacked a third failure mode on top of two that already existed.
The adapter's function was to be enabled as a Safe module. Once a contract is a module, the Safe treats it as an extension of itself โ it can execute transactions on the wallet's behalf, no separate signature required. That's the trust relationship the attacker weaponized. Not Aave's interest rate math. Not Safe's signature verification. The permission grant sitting in between them.
The two victims weren't random. They were early adopters of a convenience tool, the kind of user who wants leverage without babysitting positions. That profile โ automation-hungry, audit-indifferent โ is exactly who these adapters attract, and exactly who absorbs the loss when the wrapper fails.
I don't recommend tools I haven't stress-tested, and I've learned the hard way that "built on Aave" tells you nothing about the thing built on Aave. The base layer's security is not transitive. It doesn't flow downhill into everything composable with it.
Two classic defects stacked. That's the entire exploit. Neither is novel. Both are the kind of thing an adversarial audit catches in an afternoon.
Defect A: forgeable authentication. The adapter's open() and close() functions verified the caller by asking, essentially, "is this a Safe, and have you enabled me as a module?" The fatal flaw: the caller controls that input. The adapter was interrogating an address it did not trust, using a method that address could spoof. The attacker deployed a fake Safe contract engineered to answer "yes, module enabled" to every query, forever. The adapter believed it. Authentication bypassed in a single call. This is the confused-deputy pattern โ a privileged component tricked into acting on a malicious party's behalf because it trusted an input it should have verified independently.
Defect B: arbitrary external call. The adapter let the caller specify both the router address and the calldata. That's a design anti-pattern in its purest form. You never let untrusted input name both the target and the payload. The attacker pointed the router at the victim's own Safe and set calldata to execTransactionFromModule โ the exact privileged entry point Safe reserves for enabled modules. Every word of that call was valid. It just came from the wrong place.
Here's the kill chain, end to end. Attacker calls adapter.open(). The fake Safe passes the auth check because it's built to lie. The adapter executes the external call: router equals victim Safe, calldata equals execTransactionFromModule. The victim's Safe sees an incoming call from FlashLoopAdapter, which is legitimately enabled as its module, and trusts it. Arbitrary transaction executes. weETH and collateral leave the wallet.
The elegance is the irony. The adapter was genuinely enabled as a real module on the victim. So when it relayed the malicious call, it carried authentic credentials. The attacker didn't break Safe's security model. They borrowed its trust.
What makes this worse is the audit gap. There's no public evidence this adapter was ever independently reviewed. If it had been, the forgeable auth check should have been flagged immediately โ "caller controls the input used to verify the caller" is a textbook finding, not a subtle one. The absence of that review isn't a footnote. It's the whole ballgame.
Based on my audit experience, this is the pattern that keeps recurring across DeFi: the front-door lock is solid, but the guest list is written by whoever knocks.
There's a detail here that should scare you more than the loss. This attacker understood Safe's module system at a level most developers don't. execTransactionFromModule isn't a function you stumble into. Knowing that a trusted module can be pointed at its own host โ and that the host will honor the call because the module is already trusted โ takes real contract-reading skill. This wasn't a script kiddie. It was someone who read the integration layer and saw the seam.
Everyone's asking the wrong question. They want to know if Aave is safe. Aave is safe. The core contracts weren't touched. The real question is whether the other wallets running this same adapter are safe โ and nobody is answering that.
SlowMist asked it directly: have other wallets enabled the same module? Two wallets are confirmed drained. That number is a floor, not a ceiling. If this adapter was forked from a common template โ and cheap DeFi tooling almost always is โ the same forgeable-auth bug could be live in a dozen deployments right now, sitting quietly, waiting for someone with the same skills to come knocking.
This is composability risk in its purest form. A protocol can be perfectly secure while the integrations built around it manufacture an entirely independent attack surface. Code is law, but human greed writes the loopholes โ and here the loophole wasn't even greed. It was carelessness. Someone shipped a wrapper without adversarially testing the auth path, and the whole thing rested on that one untested assumption.
And here's the uncomfortable part for anyone running leveraged loops: the adapter didn't need to be malicious to be dangerous. It just needed to be unexamined. The same is true of every wrapper you've enabled without reading its source.
Notice who benefits from the framing, too. Aave's founder moved fast to clarify this wasn't the core contracts. That's technically correct, and it's also exactly what a founder with $33 billion in TVL should say. Both things can be true. The core is fine. The ecosystem's reputation still absorbs the indirect hit.
The loss was 114 ETH โ roughly $300,000 โ against $33 billion in TVL. That's about 0.0009%. Economically, it's a rounding error. Which is precisely the danger. An event this small gets forgotten before anyone bothers to check the other forks. The very size that makes it a non-event is the size that makes it a warning. The market will price this at zero and move on. The risk it revealed won't.
So what do you actually do with this.
Audit your own stack. If you run any looping or yield-automation adapter, verify it's been independently audited โ specifically the open() and close() authentication paths, and any function that accepts a router or calldata argument. If the tool lets callers name both the target and the payload, treat it as hostile until proven otherwise.
Separate the layers in your head. "Built on Aave" is not a security rating. "Safe module" is not a safety badge โ it's a permission grant, and permission grants are attack surface. Three stacked risks โ restaking, leverage, integration โ don't add together. They compound.
And watch the forks. The real signal isn't this hack. It's whether the same auth flaw fires again on a sibling adapter within the next ninety days. If it does, 114 ETH was the first drop, not the last.
The next wallet drained won't make the headline either. That's the problem. Will you check yours before the attacker checks it for you?