A Base Vault Lost $6 Million to a Contract That Was on the Guest List
The vault kept a list of who was allowed to touch the money. A contract was added to it before the money left.
A vault on Base lost about 1,783 wstETH on October 4, 2026, worth roughly $6 million[1]. Blockaid first counted about $2.02 million across roughly four transactions[2]. It then said losses passed $6 million[3].
Blockaid ties the path. A new contract joined the vault’s whitelist, the control meant to stop this[4]. The attacker borrowed aBaswstETH and sent it to that contract, then redeemed through Aave into wstETH[4].
The attacker’s Base address holds no material wstETH now, only a small amount of ETH[5]. Community tracking points to part of the money bridging to Ethereum through Lido, which takes days[6].
What to do: users hold no approval to revoke. The added contract did the work[4].
Who gains, who loses
Receipts
On October 4, 2026, a Base vault lost about 1,783 wstETH, worth roughly $6 million.
“An unidentified vault on Base, the Ethereum layer-2 (L2) network incubated by Coinbase, lost about 1,783 wrapped staked Ether (wstETH), worth roughly $6 million, on Sunday, October 4, 2026.”
Blockaid initially estimated that about $2.02 million had been drained from the Base vault across roughly four transactions.
“At the time, Blockaid estimated that about $2.02 million had been drained across roughly four transactions.”
The Base vault loss later exceeded $6 million while the attack was still ongoing.
“In a follow-up post in the same thread, the firm said total losses had passed $6 million and the attack was still ongoing.”
The Base attacker borrowed aBaswstETH from the vault and forwarded the tokens to an attacker-controlled contract before redeeming them through Aave into wstETH.
“According to Blockaid, a brand-new contract had been added to the vault’s whitelist, a list of addresses permitted to interact with the vault’s funds.”
The attacker’s Base address no longer held a material wstETH balance at the latest reported snapshot and showed only a small amount of ETH.
“As of the latest BaseScan snapshot, the attacker address no longer holds a material wstETH balance and shows only a small amount of ETH.”
Community tracking indicated that part of the Base exploit proceeds began bridging to Ethereum through Lido infrastructure.
“Unverified community tracking has pointed to part of the proceeds beginning a bridge to Ethereum through Lido infrastructure, a process that typically takes several days.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.