FlashLoopAdapter Safe-module exploit — attacker addresses

  • Scam type: Hack
  • Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
  • Reported: 2026-10-14
  • Last updated: 2026-10-16

FlashLoopAdapter (Aave v3 leverage-loop Safe module on Ethereum) was exploited on 2026-10-01 (~15:08 UTC); attacker kept ~114.1 WETH (~$305K). Per Blackpaper BP-1311 (https://blackpaper.wiki/incident/BP-1311/), an attack contract posed as a Safe, passed the module's self-check, and drained two victim Safes via module authority. Exploit tx: 0x75328f916b1a0878724d364da5eb12b255160b894cb36c63ed5d718efc616fc4. Also alerted by SlowMist (https://x.com/SlowMist_Team) and indexed by DeFiLlama. Addresses Blackpaper labels as attacker: - 0x42c2633438609881c8fbab82414eb9a0c45f9353 -…

Other addresses in this report: 0x42c2633438609881c8fbab82414eb9a0c45f9353, 0xf09168963ac7b31917a02aa82fa9cd667f4b67ff

Report a crypto scam · How to report a crypto scam