The Base vault attacker used a newly deployed contract that gained whitelist access, borrowed aBaswstETH through Aave V3, and moved the tokens to an attacker-controlled address.

verified span

“Blockchain security firms said a newly deployed contract gained whitelist access to the vault and borrowed against its position on Aave V3 before the assets were moved to an attacker-controlled address.”