Aave says third-party adapter exploit leaves v3 lending protocol unaffected

Traders Union
All News
Crypto
Aave v3 unaffected by exploit

Highlights

Aave founder Stani Kulechov confirms the third-party adapter exploit does not affect Aave v3 core contracts or protocol security.
SlowMist reports the attacker exploited the FlashLoopAdapter's access-control flaw, draining about 114.09 Ether ($305,000) from two Safe multisigs.
No losses occurred on Aave v3 itself, emphasizing that operational risks from third-party tools can affect DeFi integrations without compromising base protocols.

Exploit details and protocol scope

As reported by Cointelegraph, Aave founder Stani Kulechov says the incident does not affect Aave v3 itself because the vulnerable component is an external adapter built on top of the protocol, not the core contract.

Kulechov says on X that "this is not Aave v3 contract, it’s third party external adapter built on top of Aave, zero effect on Aave v3." Blockchain security firm SlowMist says the attack targets a module used to open and close leveraged Aave v3 positions through Safe wallets. The firm says an access-control flaw lets a fake Safe contract pass the adapter’s authorization check.

SlowMist says the adapter also lets the caller control the router and transaction data used for swaps. That functionality allows the attacker to execute transactions through the victim Safes, repay around 1,300 wrapped Ether in debt to unlock collateral, and drain assets including weETH and other collateral from the wallets.

Security impact on DeFi integrations

SlowMist says the attacker ultimately steals about 114.09 Ether, worth roughly $305,000, from two Safe multisigs. The firm identifies the vulnerable FlashLoopAdapter contract and the attacker’s wallet, while saying it does not find losses tied to Aave v3 itself.

The incident highlights how third-party tooling layered on decentralized finance protocols can create operational and security risks even when the underlying lending infrastructure remains unaffected. For Aave and similar platforms, that distinction matters for users assessing counterparty and smart-contract exposure across wallets, adapters and leverage tools.

Our previous coverage on Absa’s launch of regulated digital-asset custody in South Africa outlined how traditional banks are moving into secure storage and administration of crypto for institutional clients. We noted that the service, cleared by local regulators, initially supports assets such as Bitcoin, Ethereum and USDC and reflects growing demand for compliant custody solutions as the market expands.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.