Unclaimed Base Vault Keeps Its 3-of-7 Safe, Loses $6M Anyway
The Safe needs three of seven signatures to act. None of the seven signers is public.
A vault on Base lost more than $6 million on October 4, 2026, and no protocol has claimed it[1]. Blockaid spotted the exploit at 09:21 UTC[2].
PeckShield, CertiK and Exvul tallied 1,783.067 aBaswstETH borrowed and redeemed through Aave into roughly 1,783 wstETH[3]. The vault is an OpenZeppelin proxy owned by a Safe created about 324 days ago that needs three of seven signatures; none of the seven signers is public[4]. That Safe sat 25 days without a transaction before two went through[5]. About $31.7 million stayed in the vault[6].
What to do: no action needed — the failures were in multisig governance and access control, and Aave’s core contracts and Base were not affected[7].
Who gains, who loses
Receipts
A crypto vault on Coinbase's Base network lost more than $6 million on October 4, 2026, and no protocol has claimed ownership of the vault.
“A crypto vault on Coinbase's Base network lost more than $6 million on Oct. 4, yet no protocol has claimed it.”
Blockchain security firm Blockaid detected the Base vault exploit at 09:21 UTC on October 4, 2026, when about $2.02 million had already been drained.
“Blockaid spotted what looked like an exploit unfolding on a Base vault at 09:21 UTC on Oct. 4, when about $2.02 million had already drained out.”
Security firms PeckShield, CertiK and Exvul converged on the same tally that 1,783.067 aBaswstETH was borrowed from the vault and redeemed through Aave into roughly 1,783 wstETH.
“Peckshield, Certik and Exvul converged on the same tally: 1,783.067 aBaswstETH was borrowed from the vault and redeemed through Aave into roughly 1,783 wstETH.”
The drained Base vault is an OpenZeppelin transparent proxy owned by a Safe created about 324 days ago that requires three of seven signatures to act, and none of its seven signer addresses has been publicly identified.
“Onchain records show the drained vault is an Openzeppelin transparent proxy owned by a Safe created about 324 days ago. That Safe requires three of seven signatures to act, yet none of its seven signer addresses has been publicly…”
The Base vault's Safe had not executed a transaction for 25 days before two transactions were completed during the attack, which may indicate signer manipulation or internal approval.
“Notably, the Safe had not executed a transaction on the vault for 25 days before two transactions were completed during the attack.”
Approximately $31.7 million in assets reportedly remained in the attacked Base vault after the withdrawal.
“Approximately $31.7 million in assets reportedly remained in the vault after the withdrawal.”
The attack on the Base vault stemmed from failures in multi-signature governance and access control, and the core contracts of Aave and the Base chain itself were not affected.
“It is reported that the attack stemmed from failures in multi-signature governance and access control.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.