Base Vault Welcomes Fresh Contract to Wallet; Contract Leaves With Wallet
A brand-new contract joined a Base vault's whitelist. Roughly 1,783 wstETH left through it.
A vault on Base lost about 1,783 wrapped staked Ether on October 4, 2026, worth roughly $6 million[1]. Blockaid first put the loss at about $2.02 million, spread over roughly four transactions[2]. The count grew after that.
Blockaid says the way in was the whitelist[3]. A brand-new contract had been added to the vault’s list of addresses allowed to move its money. The attacker borrowed aBaswstETH and sent the assets to a contract the attacker controlled[3]. The names of all seven signers have not been made public[4].
What to do: check the whitelist on any vault, and pull any contract that does not belong there[3].
Who gains, who loses
Receipts
The Base vault incident later reached approximately 1,783 wstETH, worth roughly $6 million, according to the reported security-firm estimates.
“An unidentified vault on Base, the Ethereum layer-2 (L2) network incubated by Coinbase, lost about 1,783 wrapped staked Ether (wstETH), worth roughly $6 million, on Sunday, October 4, 2026.”
Blockaid initially estimated that approximately $2.02 million had been drained from the Base vault across roughly four transactions.
“At the time, Blockaid estimated that about $2.02 million had been drained across roughly four transactions.”
A Base vault incident involved an attacker adding a new contract to the vault whitelist, borrowing aBaswstETH, and transferring the assets to an attacker-controlled contract.
“According to Blockaid, a brand-new contract had been added to the vault’s whitelist, a list of addresses permitted to interact with the vault’s funds.”
The identities of the seven signers controlling the affected Base vault had not been publicly identified.
“The identities of all seven signers have not been made public.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.