Over $6 million drained from unidentified seven-signer Safe vault on Base
A contract whitelisted inside a Base Safe vault pulled about 1,783 aBaswstETH, roughly $6 million, redeemed through Aave V3; none of the seven signers is known.
Why it matters
S&P Global put lending-vault deposits at about $10 billion in September, up from $1.5 billion two years earlier, and launched a Vault Risk Assessment framework on the same day as the drain; the Base case shows what ratings on the underlying protocol miss, since the loss came from a contract inside the vault rather than from Aave. Immunefi's security head said an approved address could move vault assets without posting collateral, and that the whitelist weakness had been identified the previous week with no clear disclosure channel.
Where the sources disagree
Who converted the aBaswstETH into wstETH
Aave converted 1,783 aBaswstETH into wstETH
Bitcoin.com News
The attacker's contract redeemed the tokens through Aave V3 for about 1,783 wstETH
Crypto.News, CryptoSlate
Bitcoin.com News reported that Aave itself converted the tokens, while TokenPost's account relayed by Crypto.News and CryptoSlate said the attacker's contract redeemed them through Aave V3.
Which firm first flagged the outflow
Blockaid spotted it at 09:21 UTC on Oct. 4
Bitcoin.com News
CertiK flagged the vault the same day
CryptoSlate
Bitcoin.com News credits Blockaid with spotting the exploit at 09:21 UTC, while CryptoSlate reports CertiK flagged the suspicious movements involving the unnamed vault on the same day.
Key facts
About 1,783 aBaswstETH worth roughly $6 million was borrowed from a Safe vault on Base and redeemed through Aave V3 for about 1,783 wstETH.
1,783 aBaswstETHDisputed figureReported by Bitcoin.com News
Blockaid flagged the outflow at 09:21 UTC on Oct. 4, when about $2.02 million had already left the vault.
2,020,000 USDDisputed figureReported by Bitcoin.com News
The vault is a 3-of-7 Safe whose seven signers remain unidentified, and no team had publicly claimed the vault or acknowledged the loss more than 24 hours after the attack.
Reported by Bitcoin.com News
The attacker used the Safe multisignature wallet to add a malicious contract to the vault's lending whitelist, after which approved addresses could withdraw assets without posting collateral.
Reported by Crypto.News
About $31.7 million remained in the vault at the time of the incident briefing cited by Crypto.News.
31,700,000 USDReported by Crypto.News
Aave's core contracts were not exploited, and the tokens passed through an Aave V3 redemption.
Reported by Bitcoin.com News
S&P Global launched its Vault Risk Assessment framework on Oct. 4, when deposits in lending vaults had reached about $10 billion in September, up from $1.5 billion two years earlier.
10,000,000,000 USDReported by CryptoSlate
GSR is committing $100 million, mostly as a credit facility, to Hare, an onchain vault business it is building with Turtle that will initially offer Aave-powered vaults.
100,000,000 USDReported by CoinDesk
What happened
About 1,783 aBaswstETH, worth roughly $6 million, was borrowed from a Safe vault on Base on Oct. 4 and redeemed through Aave V3 for about 1,783 wstETH. Bitcoin.com News reported that Blockaid saw the first movement at 09:21 UTC, when about $2.02 million was already gone, and that roughly 40 minutes later Peckshield, Certik and Exvul had converged on a tally near 1,783 tokens across six outflows. Crypto.News cited TokenPost for the mechanism: a Safe multisignature wallet added a malicious contract to the vault's lending whitelist, and that contract then withdrew the tokens. The wallet is a 3-of-7 Safe and none of the seven signers has been identified, with no team publicly claiming the vault, acknowledging the loss or announcing remediation more than 24 hours later, according to the incident briefing Immunefi head of security Gonçalo Magalhães discussed with Crypto.News, which put the amount left in the vault at roughly $31.7 million at the time. Bitcoin.com News and CryptoSlate both state that Aave's core contracts were not exploited; the tokens simply moved through Aave's redemption path. Separately, CoinDesk reported that trading firm GSR is committing $100 million, mostly through a credit facility, to Hare, an onchain vault business it is building with Turtle.
How the story developed
- Update
S&P Global launches its vault risk framework
The Vault Risk Assessment framework went live on Oct. 4, the same day as the Base incident, with CryptoSlate reporting vault deposits near $10 billion.
- Update
Blockaid flags the Base vault outflow
About $2.02 million had left the vault at the time of detection, and losses had passed $6 million roughly 40 minutes later.
- First report
First report by Bitcoin.com News
$6M Vanishes From Crypto Vault Controlled by 7 Mystery Signers
- Update
Peckshield, Certik and Exvul converge on the same tally
The three firms put the amount taken at roughly 1,783 aBaswstETH moved across six outflows, one of them through a freshly whitelisted contract.
- Independent corroboration
Independently corroborated by Crypto.News
Base vault’s $6M exploit exposes a disclosure gap: Immunefi
- Update
TokenPost account of the whitelist step
The attacker used the Safe multisignature wallet to add a malicious contract to the vault's lending whitelist, then redeemed the tokens through Aave V3.
- Official statement
Immunefi describes the disclosure gap
Gonçalo Magalhães said a whitehat researcher had found the whitelist weakness the previous week with no clear disclosure channel, and that no team had claimed the vault or announced remediation more than 24 hours on.
- Update
CoinDesk reports GSR's $100 million commitment to Hare
The capital is mostly a credit facility funding Hare's Aave-powered stablecoin and tokenized gold vaults as anchor liquidity, with Hare built alongside Turtle.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 4 Oct 2026, 15:20 UTC: Bitcoin.com News, official — 1 independent source, 1 reports
- 6 Oct 2026, 20:13 UTC: Crypto.News — 2 independent sources, 2 reports
- 7 Oct 2026, 11:40 UTC: CryptoSlate — 3 independent sources, 3 reports
- 7 Oct 2026, 12:34 UTC: CoinDesk — 4 independent sources, 4 reports
Affected entities
Also mentioned: Galaxy Digital, Liquid Network
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin.com News Company, official | $6M Vanishes From Crypto Vault Controlled by 7 Mystery Signers | Original | |
| CoinDesk Crypto media | Crypto trading giant GSR's new vault business is a $100M bet on onchain credit | Independent | |
| CryptoSlate Crypto media | S&P brings ratings-style scrutiny to $10 billion crypto vault market as $6 million Base incident exposes risks | Independent | |
| Crypto.News Crypto media | Base vault’s $6M exploit exposes a disclosure gap: Immunefi | Independent |
Related events
ALGO Trades at $0.10 on Its 200-Day Average After a Nearly 6% Daily Gain
Blockchain.News reported on September 18 that ALGO rose nearly 6% in a day to sit exactly at its 200-day moving average of $0.10, a level it describes as resistance.
Aave opens Coinbase tokenized US stocks as collateral for USDC loans on Base
Aave's V4 Equities Hub on Base takes seven Coinbase-issued tokenized US tech stocks as collateral for USDC loans, under a $21 million borrowing cap set alongside LlamaRisk's risk parameters.
Citi Research Names Aave Leading Tokenized Finance Application as Aave V4 Expands Tokenized Stock Offerings
Citi Research identified Aave as a leading tokenized finance application while Aave Labs proposed adding tokenized SpaceX equity to its V4 Equities Hub on Base.
xStocks Deploys 1,100+ Tokenized Stocks on Monad; Superform Starts Aave-Backed Base Strategies
xStocks began minting 1,100+ tokenized US stocks on Monad, while Superform activated Aave-powered earn strategies for Coinbase tokenized stocks on Base.
MetaMask Exits Lido Validators After Infrastructure Compromise; Researchers Put Diverted Rewards at 0.36 ETH
MetaMask said a security incident hit part of its infrastructure and it is exiting affected Lido Ethereum validators, while a researcher estimates 0.36 ETH of block tips was diverted.
Aave considers higher Bitcoin and ether borrowing limits as liquidation price cushions narrow
Aave governance is weighing proposals that would raise Bitcoin and ether borrowing limits while narrowing the buffer before liquidation.
