Base Vault Exploit: How $6M in wstETH Was Drained Through Whitelist Access

A major Base vault exploit drained approximately 1,783 wstETH worth around $6 million from an unidentified vault on October 4, 2026.

The incident did not appear to involve a direct compromise of the Base network or Aave's core lending contracts. Instead, blockchain security firms said a newly deployed contract gained whitelist access to the vault, allowing it to interact with the vault's funds and borrow against its Aave V3 position.

The attack highlights a critical issue in DeFi security: even when the underlying lending protocol remains operational, weaknesses in administrative permissions or access control can expose large amounts of capital.

This Base vault hack is therefore particularly relevant for understanding how whitelist permissions, multisig approvals, and Aave positions can interact during a DeFi exploit.

Key Takeaways

• The Base wstETH exploit drained about 1,783 wstETH, worth roughly $6 million, from an unidentified vault.

• The attacker reportedly gained access through a newly deployed contract that had been added to the vault's whitelist.

• There is currently no public evidence that Aave's core contracts or the Base network itself were compromised.

How the Base Vault Exploit Unfolded

The Base DeFi exploit was first publicly flagged by blockchain security firm Blockaid at approximately 09:20 UTC on October 4.

According to the security firm's alert, a newly deployed contract had been added to the vault's whitelist. The contract was then able to borrow aBaswstETH, the Aave interest-bearing token representing supplied wstETH on Base.

The borrowed assets were subsequently forwarded to an attacker-controlled contract.

Blockaid initially estimated that approximately $2.02 million had been drained across four transactions. The estimated loss then increased as the exploit continued.

PeckShield later reported that an address associated with the attack had drained approximately 1,783 wstETH, valued at around $6 million.

CertiK separately identified a newly deployed proxy contract that borrowed approximately 1,783 aBaswstETH from the affected vault before the assets were redeemed through Aave into wstETH.

ExVul's analysis placed the total outflow at approximately 1,783.067 aBaswstETH across six transactions.

What Was Taken in the Base wstETH Exploit?

The main asset involved was wstETH, the wrapped version of Lido's staked Ether token.

Unlike stETH, wstETH uses a non-rebasing balance structure. Its value relative to ETH increases as staking rewards accrue.

The affected vault had supplied wstETH to Aave V3 on Base. In return, it held aBaswstETH, an Aave aToken representing the supplied position.

The attacker did not simply transfer wstETH directly from the vault.

Instead, based on the security firms' descriptions, the attack involved:

Whitelist access → borrowing aBaswstETH → redeeming through Aave → receiving wstETH → transferring funds

This distinction is important because the incident appears to have exploited the vault's permissions rather than a vulnerability in Aave's core lending mechanism.

How the Base Whitelist Exploit Worked

The most significant detail in the Base whitelist exploit concerns the vault's access-control system.

A whitelist is a list of addresses or contracts authorized to interact with restricted functions. If an attacker can obtain legitimate whitelist access, the malicious contract may be able to perform actions that would otherwise be blocked.

According to ExVul's timeline, the vault's owner Safe multisig removed the attacker contract from the whitelist at approximately 08:52 UTC.

One minute later, at 08:53 UTC, the same Safe re-enabled the contract.

The first borrow reportedly occurred roughly 70 seconds after the contract was re-enabled.

ExVul also reported successful ECDSA signature recoveries associated with the administrative transactions.

In simple terms, the relevant whitelist changes appear to have carried valid approvals from the vault's existing signing identities.

That shifts attention toward the security of the administrative approval process.

However, the available information does not establish exactly how those approvals were obtained.

Possible explanations could include compromised signing keys, manipulation of the signing process, or another operational failure, but none had been publicly confirmed at the time of the supplied report.

Was Aave Hacked?

One of the most important questions surrounding the incident is whether the Aave Base vault itself was compromised.

Based on the supplied security-firm reports, there is no public evidence that Aave's core lending contracts were exploited.

The attacker used the Aave V3 Base market as part of the attack path. The vault had supplied wstETH to Aave, and the attacker was able to borrow against the vault's position after obtaining the necessary whitelist permissions.

That makes the distinction between an application-level exploit and an underlying protocol exploit particularly important.

Aave's infrastructure was used to execute the borrowing and redemption process, but the reported root issue was associated with the vault's access control.

Who Owned the Affected Vault?

The identity of the affected vault's operator had not been publicly established in the supplied report.

The victim contract was identified as a TransparentUpgradeableProxy, a smart-contract architecture that allows an administrator to upgrade the logic behind a contract while maintaining its address.

Portfolio tracking data showed that the address had previously maintained substantial Aave V3 positions on Base, with large supplied assets and outstanding borrows.

This profile is consistent with a managed vault or yield strategy built on top of Aave rather than Aave's own core lending contracts.

However, no team or protocol had publicly identified itself as the operator of the vault in the supplied information.

Where Did the Stolen wstETH Go?

Blockchain activity showed interactions between the attacker-controlled address, the relevant vault and Aave infrastructure.

The stolen assets were eventually redeemed into wstETH and moved away from the affected vault.

Community tracking also suggested that some of the proceeds may have started moving toward Ethereum through Lido-related bridging infrastructure.

However, this part of the investigation was not confirmed by the vault operator or a protocol announcement.

As of the supplied report, no protocol had publicly announced a recovery effort, bounty, freeze, or confirmed recovery of the stolen funds.

Why the Base Security Exploit Matters

The Base security exploit highlights a broader problem in DeFi: security does not end with auditing the core protocol.

A vault can interact with established infrastructure such as Aave while still introducing additional risks through its own smart contracts, permission systems, upgrade mechanisms, and administrative wallets.

In this incident, the reported sequence shows why access control can be just as important as the security of the underlying lending market.

A whitelist that controls access to millions of dollars effectively becomes a high-value security boundary.

If unauthorized users can influence the whitelist or obtain valid administrative signatures, an attacker may be able to use legitimate protocol functions for an illegitimate purpose.

Base Vault Hack vs. Aave Exploit

It is useful to separate the Base vault hack from a direct Aave exploit.

In a direct protocol exploit, an attacker would typically abuse a vulnerability in the underlying lending system or its smart contracts.

Here, the supplied evidence points toward a different path:

• The vault held wstETH through Aave V3.

• A newly deployed contract gained whitelist access.

• The contract borrowed against the vault's position.

• The resulting aTokens were redeemed for wstETH.

• The assets were transferred to attacker-controlled addresses.

Therefore, the incident should currently be described as a vault access-control exploit involving Aave, rather than evidence that Aave itself was hacked.

What DeFi Users Can Learn From the Exploit

The incident offers several practical security lessons.

First, whitelist permissions need strong controls. A compromised or manipulated whitelist can effectively bypass restrictions that otherwise protect a vault.

Second, multisig security matters. Multisignature wallets reduce dependence on one private key, but they do not eliminate the risk of malicious transactions being approved by compromised or manipulated signers.

Third, upgradeable contracts require additional scrutiny. Upgrade permissions can introduce another administrative layer that must be secured.

Finally, users should understand that depositing assets into a yield vault introduces risks beyond those of the underlying protocol. Aave may be secure while a third-party strategy interacting with Aave has a separate vulnerability.

The Broader DeFi Security Picture

The Base incident came during a difficult period for crypto security.

The supplied report also referenced several other incidents involving Aave-linked infrastructure and Base during the same week, including an approximately $305,000 FlashLoopAdapter exploit and an alleged $114,000 GoldPesa GPXHooks exploit.

The broader figures were also significant. CertiK reportedly estimated approximately $766.4 million in crypto losses during September 2026, making it the year's worst month for reported crypto losses at that point.

These figures put the Base vault incident into a larger context: smart-contract risk, wallet security, administrative permissions, and third-party integrations remain important concerns across DeFi.

What Happens Next?

The biggest unanswered question is how the attacker obtained the administrative approval necessary to regain whitelist access.

The timeline reported by ExVul makes the sequence particularly notable: the contract was removed from the whitelist, re-enabled approximately one minute later, and then used for the borrowing operation shortly afterward.

A complete post-mortem would need to establish whether private keys were compromised, signers were deceived or manipulated, or another access-control failure occurred.

Until the vault operator or investigators provide additional evidence, the exact root cause should remain classified as unconfirmed.

Explore Crypto Markets on Bitrue

Security incidents like the Base vault hack show why understanding the risks behind digital assets is just as important as tracking their price movements.

If you want to explore broader cryptocurrency markets through an established trading platform, you can register on Bitrue and review its available digital asset markets and trading tools.

For DeFi users, however, exchange security and smart-contract security are separate considerations, so always review the risks associated with a specific protocol or vault before depositing funds.

Conclusion

The Base vault exploit drained approximately 1,783 wstETH worth around $6 million from an unidentified vault on October 4, 2026.

According to the supplied security-firm analysis, the attacker gained access through a newly deployed contract that had been added to the vault's whitelist. The contract then borrowed aBaswstETH against the vault's Aave V3 position and ultimately redeemed the assets into wstETH.

The most important part of the incident is the reported whitelist timeline. The attacker contract was removed from the whitelist and then re-enabled by the vault's own Safe multisig before the borrowing operation occurred.

At this stage, there is no public evidence in the supplied material that the Base network or Aave's core contracts were directly compromised.

The incident instead highlights the risks surrounding application-level access control, multisig approvals, upgradeable contracts, and third-party DeFi vaults.

For users, the lesson is straightforward: using a major lending protocol does not automatically make every strategy or vault built on top of it equally secure.

FAQ

What happened in the Base vault exploit?

An attacker drained about $6 million in wstETH from an unidentified Base vault after a contract gained whitelist access.

How much was stolen?

Approximately 1,783 wstETH, valued at around $6 million at the time of the incident.

Was Aave hacked?

The supplied evidence does not show that Aave's core lending contracts were compromised.

How did the Base whitelist exploit work?

A newly deployed contract gained whitelist access, borrowed against the vault's Aave position, and redeemed the resulting aTokens for wstETH.

Is Base itself compromised?

There is no evidence in the supplied report of a systemic compromise of the Base network.

Disclaimer: The views expressed belong exclusively to the author and do not reflect the views of this platform. This platform and its affiliates disclaim any responsibility for the accuracy or suitability of the information provided. It is for informational purposes only and not intended as financial or investment advice.