🚨 BASE VAULT DRAIN — FACTS ONLY 🚨
Date: October 4, 2026.
Network: Base (Coinbase L2).
Loss: About 1,783 wstETH, roughly $6 million.
Method: Attacker added a newly deployed contract to the vault whitelist, borrowed aBaswstETH, then redeemed it through Aave.
Vault: Unnamed. Controlled by an unidentified 3-of-7 Safe multisig.
Scope: Base core and Aave core contracts were not compromised. The failure was whitelist and access control on this vault.
Confirmation: Flagged by Blockaid during the attack. Loss and path later matched by PeckShield, CertiK, and ExVul.
Status: No public statement from the vault owners.
Date: October 4, 2026.
Network: Base (Coinbase L2).
Loss: About 1,783 wstETH, roughly $6 million.
Method: Attacker added a newly deployed contract to the vault whitelist, borrowed aBaswstETH, then redeemed it through Aave.
Vault: Unnamed. Controlled by an unidentified 3-of-7 Safe multisig.
Scope: Base core and Aave core contracts were not compromised. The failure was whitelist and access control on this vault.
Confirmation: Flagged by Blockaid during the attack. Loss and path later matched by PeckShield, CertiK, and ExVul.
Status: No public statement from the vault owners.