Base Vault's Safe Deletes the Attacker, Undoes It in a Minute, Loses $6 Million
Removed from the whitelist at 08:52 UTC, back on it at 08:53, and borrowing 70 seconds after that.
An unidentified vault on Base lost about 1,783 wstETH, worth roughly $6 million, on Sunday, October 4, 2026[1]. Blockaid flagged the exploit at 09:20 UTC while it was still running[2].
Per Blockaid, a brand-new contract had been added to the vault’s whitelist, and the attacker borrowed aBaswstETH against it[3]. Per ExVul, the owner’s Safe removed that contract from the whitelist at 08:52 UTC and re-enabled it at 08:53 UTC[4]. The removal lasted a minute. The first borrow came about 70 seconds later[5].
ExVul named the receiving contract 0xcd..F569d[6]. Per CertiK, the tokens were redeemed through Aave V3 into roughly 1,783 wstETH at the attacker’s address[7].
What to do: no action needed until the vault is named — no protocol has claimed it, issued a post-mortem, frozen funds or announced a recovery[8].
Who gains, who loses
Receipts
On October 4, 2026, an unidentified vault on Base lost about 1,783 wstETH, worth roughly $6 million.
“An unidentified vault on Base, the Ethereum layer-2 (L2) network incubated by Coinbase, lost about 1,783 wrapped staked Ether (wstETH), worth roughly $6 million, on Sunday, October 4, 2026.”
Blockaid first publicly flagged the Base vault incident at 09:20 UTC while the attack was ongoing.
“At 09:20 UTC (Coordinated Universal Time), it reported an ongoing exploit on an unnamed vault on Base.”
The attacker used a newly deployed contract that had been added to the vault’s whitelist, borrowed aBaswstETH, and forwarded the tokens to an attacker-controlled contract.
“According to Blockaid, a brand-new contract had been added to the vault’s whitelist, a list of addresses permitted to interact with the vault’s funds.”
The vault’s Safe removed the attacker contract from the whitelist at 08:52 UTC on October 4 and re-enabled it at 08:53 UTC.
“According to ExVul, the vault owner’s Safe, a multisignature (multisig) smart contract wallet that requires several approvals for each transaction, removed the attacker contract from the whitelist at 08:52 UTC.”
The first borrow occurred about 70 seconds after the contract was re-enabled.
“The first borrow came about 70 seconds after the contract was re-enabled.”
ExVul counted 1,783.067 aBaswstETH across six outflows from the vault and identified the receiving contract as 0xcd..F569d.
“It put the loss at 1,783.067 aBaswstETH across six outflows from the vault and identified the contract receiving the stolen funds as 0xcd..F569d.”
The stolen aBaswstETH was redeemed through Aave V3 into approximately 1,783 wstETH held at the attacker’s address.
“CertiK said the tokens were redeemed through Aave into roughly 1,783 wstETH held at the attacker’s address.”
No protocol had claimed the vault, issued a post-mortem, frozen funds, or announced a recovery effort or bounty offer as of the report’s publication.
“As of publication, no protocol has claimed the vault, issued a post-mortem, frozen funds or announced a recovery effort or bounty offer.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.