Back www.tokenpost.com

Tokenpost on how the damage figure developed

www.tokenpost.com • October 5, 2026

A multisignature crypto vault on Base lost more than $6 million on Oct. 4, after 1,783 wstETH left the wallet in a security incident involving assets borrowed from the vault and exchanged through Aave.

The wallet used a Safe configuration requiring three of seven signers to approve transactions. The identities of all seven signers have not been made public.

The attacker borrowed aBaswstETH held by the vault, then exchanged it for wstETH through Aave. The specific authorization weakness that enabled the transactions has not been established.

Base, the Ethereum layer-2 network, and Aave’s core contracts were not identified as having been attacked. The incident centers on the vault and its transaction approvals; no further response or recovery details were provided.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Base Vault Hack: $6 Million Stolen via Whitelist Exploit On October 4, 2026, a vault on the Ethereum layer-2 network Base was hacked, resulting in the theft of 1,783 wrapped staked Ether (wstETH), valued at approximately $6 million. The attacker gained access to the vault's whitelist by deploying a new contract, which allowed them to borrow assets against the vault's holdings on Aave V3. The attack escalated quickly, with initial loss estimates at $2 million that grew to $6 million as the exploit continued. Security firms Blockaid, PeckShield, and CertiK monitored the incident in real-time, noting that the vault's transaction approval process was compromised. The specific authorization weakness that facilitated the attack remains unidentified. No vulnerabilities in Base or Aave's core contracts were reported. The vault has not issued any public statements regarding the incident. 2 sources 61

Extracted Entities

Companies (2)

Base Ethereum