POPA ReconThird party Loop Safe module for Aave v3 hacked: about 114 ETH withdrawn from two Safe multisigs, Aave itself not affected
0x42c2633438609881c8fBAb82414eb9A0c45F9353 · 0xe3b23e47df7cd85876ac6cb05bdb9d7cd5b28520 · Gnosis Safe Proxy · 0x16bb8b912da187870c23ec6756bb3fad061283d8
0x42c2633438609881c8fBAb82414eb9A0c45F9353
0xe3b23e47df7cd85876ac6cb05bdb9d7cd5b28520
0xcfedf95a3653a128dfc2e4288758a1a1850d169f
0x16bb8b912da187870c23ec6756bb3fad061283d8
If your Safe connected the FlashLoopAdapter module, it should be disabled. The attacker fed the adapter a fake Safe that answered any question with "module enabled", and it executed its commands on behalf of the real multisigs. To unlock the collateral, it repaid about 1,300 WETH of the victims' debt on a flash loan and withdrew weETH, while the Aave core worked as normal.
If your Safe used Loop Safe, check the list of enabled modules and disable FlashLoopAdapter (0x16bb8b912da187870c23ec6756bb3fad061283d8).
Facts
SlowMist reported the attack on Loop Safe: an access control error in open()/close() of FlashLoopAdapter, losses of about 114 ETH from two multisigs. [BredoStrategy, October 2, 2026]
The attacker wallet 0x42c2...9353 received 114.1 ETH (about $306k at the time) in one transaction on October 1 at 15:08 UTC.
For victim 0xcfed...169f, in the same transaction debt token for 1,330 WETH and collateral aEthweETH for 1,306 were burned: the debt was repaid, the collateral withdrawn.
From the second victim 0xe3b2...8520, 6.43 weETH went to the adapter, about $19k at the time. [Arkham, October 1, 2026]
Cryptobriefing writes that Aave and Safe remained intact, and the failure was entirely in the adapter that decided who was allowed to trigger actions. [cryptobriefing.com, October 2, 2026]
Awaiting
Whether Aave or the Loop Safe authors will say anything about the incident and whether the stolen funds can be recovered.
post from Telegram channel BredoStrategy · post from Telegram channel Кэпитал News · post from Telegram channel Korean Alpha EN