Base DeFi Vault Exploit Drains $6M via Whitelist Access Control Failure

On October 4, 2026, an unnamed DeFi vault on the Base network lost roughly $6 million in wstETH. An attacker manipulated the vault's whitelist through a 3-of-7 Safe multisig, adding a malicious contract that withdrew 1,783 aBaswstETH in 19 minutes and redeemed them via Aave V3.

• Loss estimated at about $6M in wstETH, initial estimates were $2.02M
• 3-of-7 Safe multisig removed and re-added the contract to the whitelist within a minute
• 1,783.067 aBaswstETH withdrawn in six transfers over 19 minutes
• Aave V3 and Base itself were not compromised; failure was at the app level