The Base vault attacker added a newly deployed contract to the vault’s whitelist, borrowed interest-bearing deposits through it, and redeemed them at Aave V3 for ether derivatives.

verified span

“An investment vault on the Ethereum layer Base was drained of around 1,783 wstETH on Sunday, October 4, 2026, worth about $6 million at the October 5 price. What mattered was not a hole in a protocol but an entry on a permission list: the attacker got a freshly deployed contract onto the vault's whitelist, borrowed interest-bearing deposits through it and redeemed them at Aave V3 for Ether derivatives.”