{"id":14018,"date":"2026-10-02T19:32:48","date_gmt":"2026-10-02T19:32:48","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=14018"},"modified":"2026-10-02T19:32:48","modified_gmt":"2026-10-02T19:32:48","slug":"crypto-hackers-exploit-third-party-aave-tool-to-steal-114-eth","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=14018","title":{"rendered":"Crypto hackers exploit third-party Aave tool to steal 114 ETH"},"content":{"rendered":"

<\/p>\n

\n

A third-party lending adapter built on Aave was exploited to steal about 114 ETH, worth over $300,000, while the protocol itself remained unaffected.<\/p>\n

On Oct. 2, blockchain security firm SlowMist said the attacker compromised two Safe multisig wallets through a flaw in the FlashLoopAdapter used with Aave v3 positions. The exploit allowed the attacker to bypass the adapter\u2019s authentication checks, execute arbitrary calls, and drain collateral from the affected wallets.<\/p>\n

SlowMist estimated the direct loss at about 114.09 ETH. It said roughly 1,300 WETH of debt was also repaid during the attack to unlock collateral tied to the positions.<\/p>\n

Aave founder Stani Kulechov said the incident did not involve Aave v3\u2019s core smart contracts. He said:<\/p>\n

\n

\u201cThis is not Aave v3 contract, it\u2019s third party external adapter built on top of Aave, zero effect on Aave v3.\u201d<\/p>\n<\/blockquote>\n

The distinction is significant for Aave, the largest decentralized lending protocol, with more than $33 billion in total value locked. The exploit affected infrastructure layered on top of Aave.<\/p>\n

Fake Safe bypass opened access to collateral<\/h2>\n

SlowMist traced the vulnerability to the FlashLoopAdapter\u2019s open()<\/code> and close()<\/code> functions, which checked whether the calling Safe had enabled the adapter as a module.<\/p>\n

That verification could be spoofed.<\/p>\n