Safe modules can execute wallet transactions without requiring standard owner signatures, meaning a bug in an enabled module such as FlashLoopAdapter can grant attackers a direct route to wallet assets

From the articleAave Hack: FlashLoopAdapter Hits Two Safe WalletsAlso in Aave v3 exploit drains up to $310K after Safe module attack