Aave Founder Says V3 Unaffected After Third-Party Adapter Exploit Drains $305,000

Aave founder Stani Kulechov said Aave v3 was unaffected after an attacker exploited a third-party adapter built on top of the lending protocol, draining about $305,000 from two Safe multisig wallets.

Kulechov said the incident did not involve the Aave v3 contract itself, but rather an external adapter developed by a third party on top of Aave. He said the exploit had zero effect on Aave v3.

Blockchain security firm SlowMist said the attack targeted a module used to open and close leveraged Aave v3 positions through Safe wallets. According to SlowMist, the attacker exploited an access-control flaw that allowed a fake Safe contract to pass the adapter's authorization check.

SlowMist said the adapter also gave the caller control over the router and transaction data used for swaps. The attacker used that functionality to execute transactions through the victims' Safe wallets and drain weETH and collateral.

According to SlowMist, about 1,300 wrapped Ether (WETH) in debt was repaid during the attack to unlock collateral. The attacker ultimately stole about 114.09 Ether (ETH), worth roughly $305,000, from two Safe multisig wallets.

The security firm identified the vulnerable FlashLoopAdapter contract and the attacker's wallet, but reported no losses to Aave v3 itself.