Base Vault Loses $6 Million After Its Own Safe Re-Enabled the Attacker
The whitelist was cleared at 08:52 and restored at 08:53. Nobody has explained the second transaction.
An unidentified vault on Base lost about 1,783 wstETH, roughly $6 million, on October 4, 2026[1]. A newly deployed contract gained whitelist access, borrowed against the vault’s Aave V3 position, then moved the assets to an attacker-controlled address[2].
Blockaid flagged it at 09:20 UTC with about $2.02 million gone[3], then said losses passed $6 million while the attack continued[4]. Per ExVul, the vault owner’s Safe removed the attacker contract from the whitelist at 08:52 UTC and re-enabled it a minute later[5]; both administrative transactions showed three valid signature recoveries under the same signing identities[6]. About $31.7 million remained at risk at disclosure[7].
What to do: nothing to revoke. The attacker gained access through the vault’s own whitelist, not a holder’s approval[2]; the Safe had run no transaction for 25 days before the attack[8].
Who gains, who loses
Receipts
An unidentified vault on Base lost about 1,783 wstETH, worth roughly $6 million, on October 4, 2026.
“An unidentified vault on Base, the Ethereum layer-2 (L2) network incubated by Coinbase, lost about 1,783 wrapped staked Ether (wstETH), worth roughly $6 million, on Sunday, October 4, 2026.”
The attacker gained whitelist access through a newly deployed contract and borrowed against the vault’s Aave V3 position.
“Blockchain security firms said a newly deployed contract gained whitelist access to the vault and borrowed against its position on Aave V3 before the assets were moved to an attacker-controlled address.”
Blockaid first publicly flagged the incident at 09:20 UTC, when approximately $2.02 million had been drained across roughly four transactions.
“At the time, Blockaid estimated that about $2.02 million had been drained across roughly four transactions.”
The loss later exceeded $6 million while the attack was still ongoing.
“In a follow-up post in the same thread, the firm said total losses had passed $6 million and the attack was still ongoing.”
The vault owner’s Safe removed the attacker contract from the whitelist at 08:52 UTC and re-enabled it one minute later.
“According to ExVul, the vault owner’s Safe, a multisignature (multisig) smart contract wallet that requires several approvals for each transaction, removed the attacker contract from the whitelist at 08:52 UTC.”
Both whitelist-administration transactions had three successful ECDSA signature recoveries under the same signing identities.
“ExVul said both administrative transactions showed three successful Elliptic Curve Digital Signature Algorithm (ECDSA) signature recoveries under the same signing identities.”
Approximately $31.7 million in assets remained at risk when the incident was disclosed on October 5.
“An exploit drained about $6 million from a vault on Base, with roughly $31.7 million in assets still at risk when the incident was disclosed Oct. 5.”
The vault had not executed a Safe transaction for 25 days before the attack.
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.