{ "version": 1, "event_id": "evt_0ad3db019baf1cc2", "url": "https://xiyu.news/events/evt_0ad3db019baf1cc2/", "json": "https://xiyu.news/api/events/evt_0ad3db019baf1cc2.json", "type": "security_incident", "status": "closed", "category": "crypto", "title": { "zh": "Base 上金库遭攻击，约 1783 枚 wstETH 被盗", "en": "Base vault attacked, ~1,783 wstETH drained" }, "current_state": { "zh": "Base 上一未认领金库合约遭攻击，约 600 万美元（约 1783 枚 wstETH）通过 Safe 多签白名单机制与 Aave V3 赎回被盗；攻击者通过六笔资金流出完成抽资，部分资金已跨链桥转向以太坊；该金库内仍有约 3170 万美元资产处于风险中，Aave 核心合约和 Base 链本身未受影响。", "en": "An unclaimed vault contract on Base was attacked, with ~$6M (~1,783 wstETH) drained via a Safe multisig whitelist mechanism and Aave V3 redemption; the attacker executed six outflows and some funds were bridged toward Ethereum; ~$31.7M in assets remain at risk in the vault, while Aave core contracts and Base itself were unaffected." }, "first_seen_at": "2026-10-04T10:42:09.161969+00:00", "last_updated_at": "2026-10-05T23:27:22.359570+00:00", "last_material_change_at": "2026-10-05T23:27:22.359570+00:00", "confidence": 0.75, "updates_count": 4, "sources_count": 5, "entities": [ "aave", "about", "base", "deposit", "drained", "goplus", "million", "peckshield", "peckshieldalert", "tokens", "vault", "wsteth" ], "identifiers": [], "topics": [ "aave", "base", "defi-exploit", "defi-governance", "peckshield", "safe-multisig", "security-exploit", "wsteth" ], "updates": [ { "update_id": "upd_cee6281a3e9ab219", "event_id": "evt_0ad3db019baf1cc2", "occurred_at": "2026-10-04T01:56:00Z", "published_at": "2026-10-04T01:56:00Z", "first_seen_at": "2026-10-04T14:51:12.758742Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "PeckShieldAlert：Base 网络上 1,783 枚 wstETH 被抽走", "title_en": "PeckShieldAlert: 1,783 wstETH Drained on Base", "what_changed_zh": "PeckShieldAlert 报告称，Base 网络上一协议有 1,783 枚 wstETH 被抽走，表明已确认发生安全漏洞利用。", "what_changed_en": "PeckShieldAlert reports that 1,783 wstETH were drained from a protocol on the Base network, indicating a confirmed security exploit.", "current_state_zh": "PeckShieldAlert 报告称，Base 网络上一协议有 1,783 枚 wstETH 被抽走，表明已确认发生安全漏洞利用。", "current_state_en": "PeckShieldAlert reports that 1,783 wstETH were drained from a protocol on the Base network, indicating a confirmed security exploit.", "detailed_summary_zh": "PeckShieldAlert reports that 1,783 wstETH were drained from a protocol on the Base network, indicating a confirmed security exploit.", "detailed_summary_en": "PeckShieldAlert reports that 1,783 wstETH were drained from a protocol on the Base network, indicating a confirmed security exploit.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:7bd8c8a59bc84ecb" ], "sources": [ { "url": "https://blockchain.news/flashnews/peckshieldalert-1-783-wsteth-drained-base", "label": "blockchain.news", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_5b0a5cffb9551a05", "event_id": "evt_0ad3db019baf1cc2", "occurred_at": "2026-10-04T10:02:41Z", "published_at": "2026-10-04T10:02:41Z", "first_seen_at": "2026-10-04T10:42:09.161969Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "【PeckShield：Base 上金库攻击事件损失扩大至约 600 万美元】", "title_en": "【PeckShield：Base 上金库攻击事件损失扩大至约 600 万美元】", "what_changed_zh": "据 PeckShield 监测，Base 上一未命名金库遭攻击的损失已扩大至约 600 万美元，约合 1783 枚 wstETH。这一数字较此前 Blockaid 就该事件监测到的约 202 万美元有所上升。\n\n据 Foresight News 此前援引 Blockaid 的消息，一个新合约被添加进该金库的白名单，攻击者从金库借出 aBaswstETH 并将 aTokens 发送至该合约，在约 4 笔交易中抽走约 202 万美元。PeckShield 最新给出的约 600 万美元（约 1783 枚 wstETH）显示损失规模已超过最初统计；该金库目前未被公开点名。", "what_changed_en": "PeckShield reports that losses from an attack on an unnamed Base vault have grown to approximately $6 million, or about 1,783 wstETH, after an attacker contract was whitelisted and drained aBaswstETH/aTokens across a handful of transactions.", "current_state_zh": "据 PeckShield 监测，Base 上一未命名金库遭攻击的损失已扩大至约 600 万美元，约合 1783 枚 wstETH。这一数字较此前 Blockaid 就该事件监测到的约 202 万美元有所上升。\n\n据 Foresight News 此前援引 Blockaid 的消息，一个新合约被添加进该金库的白名单，攻击者从金库借出 aBaswstETH 并将 aTokens 发送至该合约，在约 4 笔交易中抽走约 202 万美元。PeckShield 最新给出的约 600 万美元（约 1783 枚 wstETH）显示损失规模已超过最初统计；该金库目前未被公开点名。", "current_state_en": "PeckShield reports that losses from an attack on an unnamed Base vault have grown to approximately $6 million, or about 1,783 wstETH, after an attacker contract was whitelisted and drained aBaswstETH/aTokens across a handful of transactions.", "detailed_summary_zh": "PeckShield reports that losses from an attack on an unnamed Base vault have grown to approximately $6 million, or about 1,783 wstETH, after an attacker contract was whitelisted and drained aBaswstETH/aTokens across a handful of transactions.", "detailed_summary_en": "PeckShield reports that losses from an attack on an unnamed Base vault have grown to approximately $6 million, or about 1,783 wstETH, after an attacker contract was whitelisted and drained aBaswstETH/aTokens across a handful of transactions.", "background_zh": "wstETH 是 Lido 发行的包装版流动性质押代币，是 stETH 的 DeFi 兼容版本，被广泛集成进借贷等各类协议。根据公开的代币信息，aBaswstETH 是与 Base 上 Aave 相关的 wstETH 代币。Base 是 Coinbase 推出的以太坊二层网络，其上的金库与借贷头寸常通过许可或白名单合约进行管理。", "background_en": "wstETH is Lido's wrapped liquid staking token, a DeFi-compatible version of stETH that is widely integrated across lending and other protocols. aBaswstETH is a wstETH-related token associated with Aave on Base, according to public token listings. Base is Coinbase's Ethereum layer-2 network, where vaults and lending positions are commonly managed through permissioned or whitelisted contracts.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "该事件集中于 Base 上一个持有 wstETH 相关头寸的未命名金库，因此直接风险传导路径是该金库存户及其白名单合约的交易对手方，而非 wstETH 本身。事件会影响市场对 Base 上 DeFi 金库白名单与访问控制风险的观感，并可能引发对其他采用类似许可合约设计的金库的关注。", "market_impact_en": "The incident concentrates on a single unnamed vault holding a wstETH-related position on Base, so the direct exposure runs through that vault's depositors and any counterparties to its whitelisted contracts, rather than through wstETH itself. It feeds sentiment around whitelist and access-control risk in Base DeFi vaults and could draw scrutiny to other vaults using similar permissioned-contract designs.", "importance_score": 7.0, "references": [ { "url": "https://birdeye.so/base/token/0x99CBC45ea5bb7eF3a5BC08FB1B7E56bB2442Ef0D", "title": "ABASWSTETH Price on base | Birdeye" } ], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:119717" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114545", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_f4bfc7cd7708356b", "event_id": "evt_0ad3db019baf1cc2", "occurred_at": "2026-10-05T00:14:02Z", "published_at": "2026-10-05T00:14:02Z", "first_seen_at": "2026-10-05T02:20:20.416195Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "GoPlus：Base链某金库合约遭攻击，损失约600万美元，仍有3170万美元资产处于风险", "title_en": "GoPlus：Base链某金库合约遭攻击，损失约600万美元，仍有3170万美元资产处于风险", "what_changed_zh": "GoPlus 披露攻击源于 Safe 多签将恶意合约加入借贷白名单，攻击者提取 1783 枚 aBaswstETH 并在 Aave V3 赎回约 1783 枚 wstETH，损失约 600 万美元；同时指出该金库内仍有约 3170 万美元资产处于风险中，团队在攻击前 25 天未执行 Safe 交易，可能遭社会工程学攻击或内部勾结。", "what_changed_en": "GoPlus reports the attack stemmed from a Safe multisig whitelisting a malicious contract into the lending whitelist, with the attacker withdrawing 1,783 aBaswstETH and redeeming roughly 1,783 wstETH on Aave V3 for ~$6M in losses; it adds that ~$31.7M in assets remain at risk and that the team had not executed a Safe transaction for 25 days before the attack, possibly due to social engineering or insider collusion.", "current_state_zh": "Base 上一未认领金库合约遭攻击，损失约 600 万美元（约 1783 枚 wstETH），攻击涉及 Safe 多签白名单机制与 Aave V3 赎回；截至最新报道，该金库内仍有约 3170 万美元资产处于风险中，Aave 核心合约和 Base 链本身未受影响。", "current_state_en": "An unclaimed vault contract on Base was attacked, causing ~$6M in losses (~1,783 wstETH) via a Safe multisig whitelist mechanism and Aave V3 redemption; as of the latest report, ~$31.7M in assets remain at risk in the vault, while Aave core contracts and Base itself were unaffected.", "detailed_summary_zh": "GoPlus reports that an unclaimed vault contract on Base was attacked after a Safe multisig whitelisted a malicious contract, draining ~1,783 aBaswstETH and redeeming roughly 1,783 wstETH on Aave V3 for ~$6M in losses, with ~$31.7M in assets still at risk.", "detailed_summary_en": "GoPlus reports that an unclaimed vault contract on Base was attacked after a Safe multisig whitelisted a malicious contract, draining ~1,783 aBaswstETH and redeeming roughly 1,783 wstETH on Aave V3 for ~$6M in losses, with ~$31.7M in assets still at risk.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.95, "story_ids": [ "telegram:theblockbeats:198925", "telegram:foresightnews:119728" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/370247?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/114556", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_bd31f3c1d698e384", "event_id": "evt_0ad3db019baf1cc2", "occurred_at": "2026-10-05T18:44:11Z", "published_at": "2026-10-05T18:44:11Z", "first_seen_at": "2026-10-05T23:27:22.359570Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "Base 上一金库被抽走约 600 万美元 Aave 存款代币", "title_en": "Base Vault Drained of About $6 Million in Aave Deposit Tokens", "what_changed_zh": "链上数据显示，攻击者先将新部署的合约移出金库借款方白名单，约一分钟后重新加入，随后发生六笔未经授权的资金流出；部分被盗资金经跨链桥转向以太坊。", "what_changed_en": "On-chain data shows the attacker removed a newly deployed contract from the vault's borrower whitelist, added it back about one minute later, then executed six unauthorized outflows; some stolen funds were bridged toward Ethereum.", "current_state_zh": "Base 上一未认领金库合约遭攻击，约 600 万美元（约 1783 枚 wstETH）通过 Safe 多签白名单机制与 Aave V3 赎回被盗；攻击者通过六笔资金流出完成抽资，部分资金已跨链桥转向以太坊；该金库内仍有约 3170 万美元资产处于风险中，Aave 核心合约和 Base 链本身未受影响。", "current_state_en": "An unclaimed vault contract on Base was attacked, with ~$6M (~1,783 wstETH) drained via a Safe multisig whitelist mechanism and Aave V3 redemption; the attacker executed six outflows and some funds were bridged toward Ethereum; ~$31.7M in assets remain at risk in the vault, while Aave core contracts and Base itself were unaffected.", "detailed_summary_zh": "Base 网络上的一个金库在借款方白名单被修改后，通过六笔资金流出被抽走约 600 万美元的 Aave 存款代币。所得资金被兑换为 wstETH，其中一部分随后进入跨链桥提款流程，转向以太坊。\n\n链上报道指出，问题并非源自智能合约漏洞，而是金库的借款方白名单被改动，其中一个恶意合约被加入——这凸显了访问控制配置是 Base 上 DeFi 金库用户面临的一类攻击面。\n\n报道援引的链上数据显示，新部署的合约先被移出白名单，约一分钟后又被重新加入，随后未经授权的借款行为开始出现；六笔资金流出及后续跨链桥操作表明这是蓄意执行，而非意外配置错误。有报道称损失规模约为 1,783 枚 wstETH。", "detailed_summary_en": "A vault on Base was drained of roughly $6 million in Aave deposit tokens through six outflows that followed a change to the vault's borrower whitelist. The proceeds were redeemed for wstETH, and some of those funds subsequently entered bridge withdrawals toward Ethereum.\n\nOn-chain reporting indicates the cause was not a smart contract bug but a change to the vault's borrower whitelist, where a malicious contract was added — highlighting access-control configuration as an attack surface for DeFi vault users on Base.\n\nOn-chain data cited in reports shows the newly deployed contract was removed from the whitelist and added back about one minute later, after which the unauthorized borrowing began; the six outflows and the later bridging suggest deliberate execution rather than accidental misconfiguration. One report put the amount lost at roughly 1,783 wstETH.", "background_zh": "Aave 是一个链上借贷协议，其存款代币相当于计息收据，证明用户曾完成存款，并可赎回对应的底层资产——此次即为存入 Base 上 Aave 的 wstETH。wstETH 是 Lido 的封装质押 ETH，而 Base 是由 Coinbase 开发的以太坊二层网络。", "background_en": "Aave is an onchain lending protocol where deposit tokens act as interest-bearing receipts proving a deposit was made, redeemable for the underlying asset — in this case wstETH deposited into Aave on Base. wstETH is Lido's wrapped staked ETH, and Base is a Coinbase-developed Ethereum layer-2 network.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "此次损失集中在一个持有 Aave 存款代币的 Base 金库，所得资金被换成 wstETH，其中一部分跨链桥转入以太坊，因此事件的影响路径主要涉及 wstETH 二级市场流动性和 Base 与以太坊之间的跨链桥资金流，而非协议层面的偿付能力问题。", "market_impact_en": "The loss is concentrated in a single Base vault holding Aave deposit tokens, and the proceeds were converted into wstETH with part bridged toward Ethereum, linking the incident to wstETH secondary-market liquidity and Base–Ethereum bridge flows rather than to any protocol-wide solvency issue.", "importance_score": 7.5, "references": [ { "url": "https://cryptobriefing.com/base-vault-drained-6m-aave-whitelist/", "title": "Base vault drained of $6M in Aave deposit tokens after whitelist change" }, { "url": "https://crypto2community.com/crypto-news/base-defi-vault-loses-over-6m-after-suspicious-whitelist-change", "title": "Base DeFi Vault Loses Over $6M After Suspicious Whitelist Change" }, { "url": "https://blockchainacademics.com/news/base-vault-loses-dollar6m-in-aave-tokens-after-whitelist-change", "title": "Base Vault Loses $6M in Aave Tokens After Whitelist Change" } ], "confidence": 0.92, "story_ids": [ "rss:thedefiant.io_api_feed:877ff7bffc0aa39a" ], "sources": [ { "url": "https://thedefiant.io/news/hacks/base-vault-drained-of-about-6-million-in-aave-deposit-tokens", "label": "The Defiant", "source_type": "rss", "official": false } ] } ] }