Aave founder Stani Kulechov said the protocol’s V3 smart contracts were not affected after an attacker used a vulnerability in an external adapter to take about $305,000 from two Safe multisignature wallets.
According to Cointelegraph, the incident involved a third-party tool built on top of Aave V3 rather than the lending protocol’s own contracts. The attack targeted an adapter designed to help users open and close leveraged Aave V3 positions through Safe wallets.
How the exploit worked
Blockchain security firm SlowMist said the attacker took advantage of a weakness in the adapter’s access controls. The flaw allowed a fake Safe contract to pass the adapter’s authorization check, giving the attacker a route to interact with the affected wallets.
The adapter also gave the caller control over the router and transaction data used for swaps. In practice, that functionality enabled the attacker to execute transactions through the victim Safes and remove weETH and other collateral.
A Safe multisignature wallet requires transactions to be approved by more than one authorized signer. In this case, however, the issue was reported in the external adapter used with the wallets, not in the underlying Aave V3 contracts.
Losses and affected contracts
SlowMist said approximately 1,300 wrapped Ether, or WETH, in debt was repaid during the attack. Repaying the debt unlocked collateral held in the wallets, allowing the attacker to take about 114.09 Ether, or ETH.
The stolen ETH was valued at roughly $305,000 in the report. The security firm identified the vulnerable FlashLoopAdapter contract and the attacker’s wallet. It did not report losses to Aave V3 itself.
Kulechov reinforced that distinction in a post on X, saying the incident involved a “third party external adapter built on top of Aave” and had “zero effect on Aave v3.” His comments separated the security problem in the add-on tool from the core lending protocol.
Moneyiar market picture
Moneyiar market data recorded at 09:19 on October 3, 2026, showed Aave’s AAVE token at $181.06271321, down 0.64% over 24 hours but up 18.13% over seven days.
The same data showed:
- Cardano (ADA): $0.2436717241, down 4.85% in 24 hours and 3.82% over seven days.
- Aptos (APT): $0.7878870162, down 4.87% in 24 hours and 6.30% over seven days.
- Plasma (XPL): $0.0927822691, down 4.19% in 24 hours and 21.28% over seven days.
These figures are Moneyiar data at the stated time and describe token-market prices, not the value of the assets taken in the exploit.
