The attacker exploited an access-control vulnerability in FlashLoopAdapter by spoofing Safe authentication and bypassing the module authorization check. By controlling the swapRouter and swapCalldata, the attacker targeted the victim Safes with execTransactionFromModule() and executed unauthorized transactions. The attacker also used a Morpho WETH flash loan to repay the affected Safe’s Aave V3 debt and unlock its collateral, ultimately draining weETH from two Safes and retaining approximately 114.09 ETH, worth about $305,000.