Quick answer: On October 4, 2026, an unnamed vault on Base lost roughly 1,783 wstETH, about $6 million, after its Safe multisig approved two whitelist edits that let a brand-new attacker contract borrow against the vault’s Aave V3 position. Security firms say Aave and Base weren’t breached. The weak point was the approval process behind the vault’s admin keys, and how those approvals were obtained still hasn’t been explained publicly.
That distinction matters more than the dollar figure. Six million is small next to the month that just ended, but the way it happened is the kind of failure that audits don’t catch and that most DeFi users never check for. Here’s what’s been reported, what hasn’t been established, and what you can actually look at before parking money in a vault.
What happened on Base on October 4
The sequence, as reconstructed by on-chain analysts, is short. At about 08:52 UTC, a contract was removed from the vault’s borrower whitelist. About a minute later, at roughly 08:53, the same contract was added back. Both transactions carried valid signatures from the vault’s Safe multisig, which requires three of seven signers.
Once whitelisted, the contract borrowed the vault’s aBaswstETH, the receipt tokens that represent wrapped staked ETH deposited in Aave V3 on Base. It forwarded them to an attacker-controlled address and redeemed them through Aave for plain wstETH. Reports say the first outflow landed within about 70 seconds of the re-whitelisting, and that six separate outflows were counted in total.
Blockaid was among the first to flag it, initially at around $2.02 million. PeckShield, CertiK and ExVul then converged on the final tally: 1,783 wstETH, roughly $6 million. How long the drain took depends on who you read. One outlet puts it at about 25 minutes, others at about 40, which likely reflects different start points rather than a real disagreement.
Aave wasn’t hacked, and that’s the point
Several reports are explicit that this wasn’t a bug in Aave’s core lending contracts or in the Base network. Aave did what it’s built to do: a contract with permission to borrow against a position borrowed against it. The vault’s own access list was the thing that failed.
If you’ve read our explainer on how Aave and Compound lending works, you know the protocol side is mostly over-collateralised math. That math can be flawless and still lose your money if the wrapper around it, the vault that holds the position, hands out permissions too easily. Think of Aave as a very good bank vault door, and the whitelist as the list of people who have the combination.
The multisig detail nobody can explain yet
This is the part worth sitting with. A 3-of-7 Safe is a perfectly respectable setup on paper. Three valid signatures were recovered on both the removal and re-addition transactions. So the cryptography worked. What’s unknown is how those three approvals came about.
Reports raise a few possibilities: compromised signer keys, a manipulated signing workflow (signers approving something that looked harmless), social engineering, or collusion. TokenPost notes that social engineering or collusion were raised as possible explanations, but neither has been established. No post-mortem exists, and none of the seven signer addresses has been publicly identified by the firms tracking the incident.
One more oddity: according to Blockaid-based reporting, the multisig hadn’t executed a single transaction in about 25 days, then approved two whitelist edits inside roughly a minute. A dormant admin wallet that suddenly fires twice in sixty seconds is a pattern. It isn’t proof of anything, but it’s exactly the kind of signal a monitoring alert should catch.
There’s also a loose end worth being honest about. As of the reports we reviewed, nobody has publicly claimed the vault. That makes it hard to say who the depositors were, whether they’ve been told, or whether anything will be made whole.
$31.7 million still exposed, according to analysts
Several outlets, including MPost and Finwire (which relays an Immunefi briefing), say about $31.7 million remained in the vault under the same permission structure at the time of reporting. Treat that number carefully. It’s an estimate from secondary reporting, we still couldn’t verify it against an on-chain or operator source, and the balance may have changed since. Editor’s Update: October 7, 2026. As of the coverage we reviewed, no protocol had claimed the vault, issued a post-mortem, frozen funds or announced a bounty. Immunefi’s head of security said any whitelisted address could take the vault’s aBaswstETH with no collateral needed, and argued the vault’s anonymous ownership put any white-hat who spotted the flaw in a bind, since trying to alert the team or secure the funds could invite legal risk. Still, the logic holds: if the attacker’s route depended on the signing process rather than a code bug, then whatever compromised it could still be live until the signers rotate keys or the vault is paused.
Why a timelock would have changed this
The standard defence against this scenario is a timelock: a mandatory delay between an admin action being approved and taking effect. If these whitelist edits had sat in a queue for, say, 24 or 48 hours, anyone monitoring the vault, including its own team, would have had time to notice a strange new contract and cancel the change. No report we found says the vault had one, and the timeline suggests it didn’t: the contract was borrowing within about a minute of being re-admitted. That’s our reading of the timeline, not a confirmed finding.
Timelocks aren’t free. They slow down legitimate emergency responses, and some teams skip them for exactly that reason. But for any permission that lets a contract borrow against pooled funds, the trade-off is hard to defend. Speed is a feature for traders. For an admin key, it’s a liability.
A realistic scenario: what you’d have seen as a depositor
Imagine you’d put some wstETH into a Base yield vault last month because the advertised return on top of Aave looked tidy. The interface showed Aave’s logo, an audit badge and a decent TVL figure. Nothing on the page told you who controlled the vault’s whitelist, or that the admin Safe had been silent for weeks.
On the morning of October 4, nothing would have looked wrong from the front end until the balance did. By the time most people noticed, the six outflows were already done. That’s the uncomfortable truth about this class of incident: there’s often no warning on the product page, because the risk lives in a wallet configuration that the page never shows.
How this fits a rough month for security
It’s worth keeping the scale straight. September 2026 was the worst month of the year for hacks. PeckShield counted 55 incidents totalling about $766.5 million, while CertiK counted 97 incidents at about $768.4 million, a gap of under $2 million between two independent trackers. Most of that came from two events: the Bitget breach (about $388 million per those tallies; we covered it in our Bitget hack breakdown) and the Liquid Network incident, where roughly $320 million was taken and more than $270 million was reportedly recovered. CertiK’s year-to-date figure was about $2.68 billion across 656 incidents.
One report called this the fourth Aave-linked exploit on Base within a week. Editor’s Update: October 7, 2026. CryptoTimes now spells out that count: the earlier three were the FlashLoopAdapter exploit on Safe wallets (roughly $305,000, also covered by Cointelegraph and Crypto.News) and an exploit tied to GoldPesa’s GPXHooks, both reported on October 2 and 3. The label is looser than it sounds, though. Those incidents involved third-party modules and hooks, not Aave’s core v3 contracts, and the mechanisms differ from this vault’s whitelist failure. What they share is that attackers are probing the wrappers around Aave, such as Safe configuration and add-on modules, rather than Aave itself.
The pattern isn’t new. Bridge and infrastructure compromises have long outweighed pure code bugs in dollar terms, something we looked at after the SingularityNET bridge hack. Base itself has also been in the news for the opposite reason lately: deliberate admin power. Our piece on the Base Cobalt upgrade and issuer seizure powers covers a different kind of control, but the theme is the same. Whoever holds the keys holds the risk.
What to check before you deposit in a vault
You can’t audit a team’s internal security from the outside. You can look for a few public signals, though, and most take under ten minutes.
- Who controls the admin Safe? Find the vault’s owner or admin address on a block explorer. If it’s a Safe, check the threshold and whether signers are publicly identified.
- Is there a timelock? If admin changes take effect instantly, you’re trusting the signers completely.
- Is the team real? This incident’s vault still hasn’t been claimed by anyone. An anonymous operator with no public contact is a risk in its own right.
- What can the whitelist do? A permission that lets a contract borrow against pooled deposits is far more dangerous than one that merely lets it view balances.
- Is the vault monitored? Ask whether alerts exist for dormant-wallet activity or whitelist changes.
Our guides on MPC wallets and institutional custody and seed phrase security cover the key-management side from a user’s perspective. The vault-operator side is the same problem at a larger scale.
What we don’t know yet
It’s early, and the honest list of unknowns is long.
- Who operates the vault, and whether depositors will be compensated.
- How the three signatures were obtained.
- Where the stolen wstETH goes next. One report notes some funds were routed through Lido’s Base-to-Ethereum bridge, which has a 7-day settlement window, and says that unloading the stolen wstETH could put near-term pressure on its peg. Another says broader systemic risk appeared limited, and no peg impact had been reported.
- Whether the remaining balance, estimated at $31.7 million, was secured.
We’ll treat any post-mortem from the operator as the primary source once it exists. Until then, everything above comes from security firms’ public posts as relayed by news outlets, and details may shift.
Frequently asked questions
Was Aave hacked in the Base vault exploit?
No. Multiple reports say Aave V3’s core contracts and the Base network weren’t compromised. The attacker used a vault-level whitelist to borrow against the vault’s own Aave position.
How much was stolen?
About 1,783 wstETH, or roughly $6 million, according to PeckShield, CertiK and ExVul as relayed by news outlets. Blockaid first flagged around $2.02 million before the total grew.
Which vault was it?
That’s unknown. As of the reports we reviewed, no team had claimed the vault, and the seven signer addresses hadn’t been publicly identified.
Can a multisig be hacked even with valid signatures?
Valid signatures only prove that enough keys signed. If signers are tricked, their keys are compromised, or a signing workflow is manipulated, the signatures can be valid and the action still malicious. It’s one reason many teams add timelocks and monitoring on top of multisigs.
Should I avoid DeFi vaults entirely?
That’s your call, and it depends on your risk tolerance. What this incident suggests is that vault governance deserves as much scrutiny as the underlying protocol. This isn’t financial advice.
Key takeaways
- About 1,783 wstETH (~$6M) left an unnamed Base vault on October 4 after two whitelist edits approved by a 3-of-7 Safe.
- Aave V3 and Base weren’t breached, per multiple reports. The failure was in admin access control.
- How the signatures were obtained is unexplained, and no post-mortem exists yet.
- An estimated $31.7M was reportedly still at risk, a secondary-source figure we couldn’t verify.
- Timelocks, public signers and monitoring are the practical signals to look for before depositing.
Disclaimer: This article is for educational purposes only and isn’t financial advice. Crypto and DeFi carry risk of total loss. Do your own research before depositing funds anywhere.
Want more on how DeFi security fails and how to spot it early? Browse our related guides above, and subscribe to FiscalFrontier for new research-first coverage as this story develops.
References and sources
- Crypto Briefing: Base vault drained of $6M in Aave deposit tokens after whitelist change
- MPost: Unidentified Base Vault Hit By $6M Multisig Exploit, Leaving $31.7M At Risk
- Bitcoin.com News: $6M Vanishes From Crypto Vault Controlled by 7 Mystery Signers
- Blockfence: Anonymous Base Vault Loses $6M After Multisig Re-Whitelists Attacker Contract
- Blockonomi: Base DeFi Vault Exploit Drains $6M
- TokenPost: Base Vault Exploit Drains About $6 Million
- CryptoTicker: Base Vault Hack: $6 Million via a Permission List
- Cryptonomist: September 2026 crypto hacks (PeckShield and CertiK totals)