The Whitelist Was Right at 08:52 and Wrong Again at 08:53
Whitelist off at 08:52. Whitelist on at 08:53. Both signed correctly.
An unnamed vault on Base lost about 1,783 wstETH, worth roughly $6 million, on Sunday, October 4, 2026[1]. Chain-watching firms said a new contract got whitelist access to the vault[2]. It borrowed aBaswstETH against the vault’s Aave V3 position[2]. Then it sent them to an attacker-controlled address[2].
ExVul says the owner’s Safe took the contract off the whitelist at 08:52 UTC[3]. The Safe put it back at 08:53, one minute later[3]. The Safe’s own signers signed both[4]. Blockaid first put the loss at about $2.02 million over roughly four transactions[5]. As of the report, no protocol had claimed the vault, frozen funds or offered a way to get money back[6].
What to do: no action needed for Aave lenders[7]. Crypto Times states no public evidence ties the drain to Aave’s core contracts or Base itself[7].
Who gains, who loses
Receipts
On October 4, 2026, an unidentified Base vault lost approximately 1,783 wstETH, worth roughly $6 million.
“An unidentified vault on Base, the Ethereum layer-2 (L2) network incubated by Coinbase, lost about 1,783 wrapped staked Ether (wstETH), worth roughly $6 million, on Sunday, October 4, 2026.”
The Base vault attacker used a newly deployed contract that gained whitelist access, borrowed aBaswstETH through Aave V3, and moved the tokens to an attacker-controlled address.
“Blockchain security firms said a newly deployed contract gained whitelist access to the vault and borrowed against its position on Aave V3 before the assets were moved to an attacker-controlled address.”
The Base vault's Safe removed the attacker contract from its whitelist at 08:52 UTC and re-enabled it at 08:53 UTC on October 4, 2026.
“According to ExVul, the vault owner’s Safe, a multisignature (multisig) smart contract wallet that requires several approvals for each transaction, removed the attacker contract from the whitelist at 08:52 UTC.”
The Base vault's whitelist re-enablement carried valid approvals from the Safe's existing signers.
“ExVul said both administrative transactions showed three successful Elliptic Curve Digital Signature Algorithm (ECDSA) signature recoveries under the same signing identities.”
Blockaid initially estimated that approximately $2.02 million had been drained from the Base vault across roughly four transactions.
“At the time, Blockaid estimated that about $2.02 million had been drained across roughly four transactions.”
As of the report's publication, no protocol had claimed the Base vault, issued a post-mortem, frozen funds, or announced a recovery effort or bounty offer.
“As of publication, no protocol has claimed the vault, issued a post-mortem, frozen funds or announced a recovery effort or bounty offer.”
The Base vault incident had not been attributed to a compromise of Aave's core lending contracts or the Base network.
“There is no public evidence that Aave’s core lending contracts or the Base network were compromised.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.