Base Vault Whitelists a Newly Deployed Contract and Loses $6 Million
A newly deployed contract got whitelist access to a Base vault, borrowed against its Aave V3 position, and 1,783 wstETH left.
A vault on Base lost about 1,783 wstETH, worth roughly $6 million, on Sunday, October 4[1].
Firms that check code said a contract deployed that day got whitelist access to the vault, borrowed against its Aave V3 position, and moved the assets to an address the attacker ran[2].
Blockaid first put the loss at about $2.02 million across roughly four transactions[3]. A follow-up post in the same thread put the total past $6 million, with the attack still going[4]. ExVul counted 1,783.067 aBaswstETH across six outflows and named the contract that got the funds 0xcd..F569d[5].
What to do: stay away from the contract ExVul named, 0xcd..F569d, and the vault it got into, while the attack is still going[5][4].
Who gains, who loses
Receipts
On October 4, an unidentified vault on Base lost about 1,783 wstETH, worth roughly $6 million.
“An unidentified vault on Base, the Ethereum layer-2 (L2) network incubated by Coinbase, lost about 1,783 wrapped staked Ether (wstETH), worth roughly $6 million, on Sunday, October 4, 2026.”
The Base vault attack involved a newly deployed contract gaining whitelist access, borrowing against the vault’s Aave V3 position, and moving the assets to an attacker-controlled address.
“Blockchain security firms said a newly deployed contract gained whitelist access to the vault and borrowed against its position on Aave V3 before the assets were moved to an attacker-controlled address.”
Blockaid initially estimated that approximately $2.02 million had been drained from the Base vault across roughly four transactions.
“At the time, Blockaid estimated that about $2.02 million had been drained across roughly four transactions.”
The Base vault loss later exceeded $6 million while the attack remained ongoing.
“In a follow-up post in the same thread, the firm said total losses had passed $6 million and the attack was still ongoing.”
ExVul reported that 1,783.067 aBaswstETH was removed from the Base vault across six outflows and identified the receiving contract as 0xcd..F569d.
“It put the loss at 1,783.067 aBaswstETH across six outflows from the vault and identified the contract receiving the stolen funds as 0xcd..F569d.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.