Base Chain Vault Hack (October 2026)

Summary

On October 4, 2026, an unidentified yield vault deployed on Coinbase's Base network lost approximately 1,783 wstETH (roughly $6 million) after an attacker gained whitelist privileges on the vault and used a newly deployed contract to borrow against the vault's Aave position before redeeming the borrowed receipt tokens for the underlying collateral. The vault is controlled by an anonymous 3-of-7 Safe multisig whose signers have never been publicly disclosed, and neither Base's core infrastructure nor Aave's core contracts were found to be compromised. The incident remains only partially explained: security firms confirmed the mechanics of the drain but had not, as of publication, determined how the attacker obtained whitelist approval or identified the vault's operator.