Aave v3 Exploit Drains Two Safe Wallets for $305K
The $305K is small for an Aave v3 incident; the concern is the access-control bug in FlashLoopAdapter sitting inside a module Safe multisigs opt into by default.
The $305K is small for an Aave v3 incident; the concern is the access-control bug in FlashLoopAdapter sitting inside a module Safe multisigs opt into by default.
The 114 ETH drain is small in size. The bigger read is the access-control failure in FlashLoopAdapter that bypassed Safe authorization, because a Safe is only as secure as the modules it ships.
Public identification plus a hard 48-hour clock is the template more protocols are copying. The next move is law enforcement referrals and on-chain pursuit, not further negotiation.
A patch and full reimbursement pledge limit the immediate fallout, but deposits and withdrawals across supported chains face a roughly 12-hour suspension.
The team has pledged full compensation, but deposits and withdrawals across 11 networks face a longer shutdown than the core service.
A patch and reimbursement pledge address the immediate losses, but deposits and withdrawals remain restricted on several networks.
The reported movement of stolen funds through KuCoin and into Bitcoin puts the asset trail alongside the loss itself in focus.
Recovery funding has no disclosed amount or payment timetable, and Zano has yet to publish eligibility rules or a claims process.
The bug affected a specific shutdown-script setup and was not a Bitcoin base-layer issue, but older nodes face an urgent upgrade decision.
The market caps borrowing at $21M, but frozen weekend feeds could delay liquidations and leave opt-in USDC suppliers carrying any shortfall.
The emergency patch stopped further movement from one attacker-linked address, but custody is not compensation: six multisig signers require a public mandate before distribution.
The case puts provider guidance and customer configuration at the center of bridge security, as major projects shift assets toward Chainlink CCIP.
Closing the marketplace did not cancel onchain permissions, so former users may still need to revoke access to protect assets held in approved wallets.
A whitehat operation recovered 23,155 NFTs, but 660 WETH remained at risk, and users must revoke old approvals before reclaiming rescued assets.
The chain’s recovery does not reopen Kraken’s trading or funding routes, leaving exchange customers subject to separate restrictions with no posted end time.
The NFTs are reported safe, but their movement from hundreds of wallets puts wallet security and the vulnerability's scope in focus.
The rescue secured NFTs worth more than $5.7 million, but about 660 WETH was not recovered in time and similar vulnerabilities affect two processor versions.
Card purchases and every other Payy Network transaction are halted, while the company has disclosed neither customer losses nor a restart timetable.
The British Columbia claim puts LayerZero’s role in the bridge security failure at the center of a dispute over one of crypto’s largest reported exploits.
The flaw could expose merchants to unpaid deliveries, but sender funds remained safe and patches for both defects shipped before the 2026 disclosure.