$6m drained from anonymous Base vault controlled by 3-of-7 Safe

Key points

• Blockaid spotted the exploit at 09:21 UTC on 4 Oct, when about $2.02m had already gone; losses passed $6m roughly 40 minutes later.
• Peckshield, Certik and Exvul traced about 1,783.067 aBaswstETH borrowed from the vault and redeemed through Aave on Base into roughly 1,783 wstETH.
• The vault's owner is a 3-of-7 Safe created about 324 days ago whose seven signers have not been publicly identified.

A Base vault lost more than $6m on 4 Oct, and the identity of its owner is still unknown. Blockaid first flagged the drain at 09:21 UTC, when about $2.02m had already left, Bitcoin.com News reports. Within roughly 40 minutes the loss had passed $6m.

Peckshield, Certik and Exvul reached similar figures. Exvul counted six outflows.

Vault drained on Base

Onchain records show the drained vault is an Openzeppelin transparent proxy whose owner is a Safe created about 324 days ago. That Safe needs three of seven signatures to act, but carries no public protocol name and none of its signers has been identified. The proxy is 0xD1895f2019c2152FC2b9022D57f19198c4CFCABC and its Safe owner is 0x6b27512a5943Ed327f6cb6C3EC1f0398229f42C4.

Security firms have not blamed Base itself or Aave's core contracts, and the exact authorisation failure is unconfirmed. The article says systemic risk looks contained for now, though selling the stolen wstETH could pressure its peg.

What to watch: The story is still developing; the article says more details will be added as new information emerges, with no confirmed account of a bug or key compromise yet published.

Read the full story on Bitcoin.com News →