Aave founder Stani Kulechov said an attacker drained about $305,000 from two Safe multisig wallets by exploiting a third-party adapter, while the protocol's core v3 contracts were not affected.
Disclaimer: News content is based on public news sources and provided for information only. It does not constitute investment advice.
On October 2, 2026, Cointelegraph reported that an attacker exploited a third-party adapter connected to Aave, draining approximately $305,000 from two Safe multisig wallets. Aave founder Stani Kulechov stated that Aave v3 itself was unaffected by the incident. The statement distinguishes the protocol's core contracts from the peripheral adapter that was targeted. The source does not name the adapter, the blockchain involved, or the entity operating the affected wallets. This matters because it frames the loss as an integration-layer failure rather than a breach of Aave's main lending market.
Aave v3 is the third major version of the Aave lending protocol, where users supply and borrow digital assets through audited smart contracts. Third-party adapters are separate contracts that allow external systems to interact with Aave, and they often hold or route user permissions. Because the exploit targeted an adapter, the attacker did not need to break Aave's core contracts to move funds out of the two Safe wallets. Kulechov's claim that v3 was unaffected rests on the idea that the main pool's logic and state remained intact. The distinction is central to how the incident is being characterized: the loss occurred at a connection point, not inside the lending pool.
Safe is a widely used smart contract wallet that requires multiple private keys to approve a transaction. In this case, the attacker drained about $305,000 from two Safe multisig wallets, according to the source. A multisig reduces single-key risk, but it does not eliminate risks that come from the contracts or permissions those wallets interact with. If an adapter has been granted approval to move assets, an exploit of that adapter can bypass the need to compromise every signer. This incident therefore highlights the permission layer between wallets and DeFi protocols as a potential attack surface.
Losses in decentralized finance have repeatedly involved peripheral contracts, bridges, and oracles rather than the core code of major protocols. Attackers often look for contracts that hold privileged approvals or connect multiple systems, since a single flaw there can affect many users. In this case, the source does not specify which adapter was exploited, which chain hosted the wallets, or whether any funds were recovered. Those details would determine the scope of affected users and the potential for reimbursement or further security changes. Without them, the main confirmed facts remain the approximate $305,000 loss and Kulechov's statement that Aave v3 was not affected.
An attacker exploited a third-party adapter connected to Aave and drained approximately $305,000 from two Safe multisig wallets, according to Cointelegraph. Aave founder Stani Kulechov said the incident did not affect Aave v3. The source did not identify the adapter or the chain involved.
Kulechov stated that Aave v3 was unaffected, and the reported loss came from two Safe multisig wallets rather than the protocol's core contracts. The attacker targeted a third-party adapter, which is a separate integration layer. This distinction is important because it limits the reported scope of the incident to that adapter and the wallets connected to it.
A third-party adapter is a separate smart contract that helps external systems or applications interact with a protocol like Aave. It can route transactions, manage approvals, or translate instructions between different pieces of software. Because adapters often hold permissions, a flaw in one can expose user funds even if the underlying protocol's core contracts remain secure.
The Exploit and Aave's Response
Core Protocol vs. Peripheral Integrations
Why Safe Multisig Wallets Were Involved
Patterns in DeFi Exploits and Unanswered Questions
This article is rewritten from public news sources and further processed by AI. It is provided for information only and does not constitute investment advice — refer to the original source for the authoritative version.
Safe is a smart contract wallet that requires multiple signatures to approve transactions, which is designed to reduce the risk of a single compromised key. In this incident, the attacker drained funds from two Safe multisig wallets by exploiting a third-party adapter they interacted with. That shows that multisig protection does not automatically cover risks introduced by external contracts or permissions.
The reported loss is about $305,000, based on the source. It is not clear from the source which adapter was exploited, which blockchain was involved, or whether any of the funds have been recovered. Additional details would be needed to understand the full impact on users and any follow-up security measures.
Based on the source, Kulechov says Aave v3 was unaffected, and the incident concerns a third-party adapter rather than the core lending pool. That does not mean integrations around a protocol carry no risk, since adapters and permissions can still be exploited. The confirmed facts point to a loss at the integration layer, not a failure of Aave's main contracts.
