Hack history / 2026 / Hack or exploit
FlashLoopAdapter
Hack or exploit on Oct 1, 2026 · Improper Access Control
SOURCES AGREE ON DATE AND LOSS · 3 SOURCES
Lost
$305K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,308
among thefts by dollars lost
What happened
FlashLoopAdapter’s open()/close() authorization trusted any caller whose isModuleEnabled() response returned true, allowing an attacker-controlled fake Safe to pass the check. The attacker then supplied each real victim Safe as swapRouter and encoded execTransactionFromModule(...) as arbitrary swapCalldata. Because FlashLoopAdapter was already an enabled module on those Safes, they accepted the calls and transferred or withdrew collateral to the attacker
Details
- Date
- Oct 1, 2026
- Kind
- Hack or exploit
- Method
- Improper Access Control
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Ethereum
Reported by
Related incidents
SUPERFORTUNE AI 2026 · Hack or exploit · $15.2M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Crypto DAO 2026 · Hack or exploit · $8.2M
Coinsbuy 2026 · Hack or exploit · $7.9M
New Market Trading 2026 · Hack or exploit · $4M
MANTRA Chain 2026 · Hack or exploit · $3.6M
Cite this page
SwanBluechip, "FlashLoopAdapter hack, Oct 1, 2026: $305K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht02fa7e5be6/ (data as of 2026-10-31).