Current outcome
An unclaimed vault contract on Base was attacked, with ~$6M (~1,783 wstETH) drained via a Safe multisig whitelist mechanism and Aave V3 redemption; the attacker executed six outflows and some funds were bridged toward Ethereum; ~$31.7M in assets remain at risk in the vault, while Aave core contracts and Base itself were unaffected.
Progress timeline
4 material updates- #01
PeckShieldAlert: 1,783 wstETH Drained on Base
PeckShieldAlert reports that 1,783 wstETH were drained from a protocol on the Base network, indicating a confirmed security exploit.
Source evidence: blockchain.news
- #02
【PeckShield：Base 上金库攻击事件损失扩大至约 600 万美元】
PeckShield reports that losses from an attack on an unnamed Base vault have grown to approximately $6 million, or about 1,783 wstETH, after an attacker contract was whitelisted and drained aBaswstETH/aTokens across a handful of transactions.
Source evidence: foresightnews
- #03
GoPlus：Base链某金库合约遭攻击，损失约600万美元，仍有3170万美元资产处于风险
GoPlus reports the attack stemmed from a Safe multisig whitelisting a malicious contract into the lending whitelist, with the attacker withdrawing 1,783 aBaswstETH and redeeming roughly 1,783 wstETH on Aave V3 for ~$6M in losses; it adds that ~$31.7M in assets remain at risk and that the team had not executed a Safe transaction for 25 days before the attack, possibly due to social engineering or insider collusion.
State after update: An unclaimed vault contract on Base was attacked, causing ~$6M in losses (~1,783 wstETH) via a Safe multisig whitelist mechanism and Aave V3 redemption; as of the latest report, ~$31.7M in assets remain at risk in the vault, while Aave core contracts and Base itself were unaffected.
Source evidence: theblockbeats · foresightnews
- #04
Base Vault Drained of About $6 Million in Aave Deposit Tokens
On-chain data shows the attacker removed a newly deployed contract from the vault's borrower whitelist, added it back about one minute later, then executed six unauthorized outflows; some stolen funds were bridged toward Ethereum.
State after update: An unclaimed vault contract on Base was attacked, with ~$6M (~1,783 wstETH) drained via a Safe multisig whitelist mechanism and Aave V3 redemption; the attacker executed six outflows and some funds were bridged toward Ethereum; ~$31.7M in assets remain at risk in the vault, while Aave core contracts and Base itself were unaffected.
Source evidence: The Defiant