Unidentified Base Vault (October 2026 Whitelist Exploit)

30 September 2026

A security flaw in the vault's access control was allegedly identified approximately four days before the exploit, but researchers lacked a public disclosure channel as the vault's operator had not identified itself.

4 October 2026

At 08:52 UTC, the vault's 3-of-7 Safe multisig executed a transaction removing a newly deployed, attacker-controlled contract from the vault's borrower whitelist.

4 October 2026

At 08:53 UTC — approximately one minute later — the same multisig re-added the identical attacker contract to the whitelist. Both transactions carried valid ECDSA signatures from existing signers.

4 October 2026

Between 08:53 and 09:12 UTC (~19 minutes), the attacker's whitelisted contract withdrew 1,783.067 aBaswstETH from the vault across six separate transfers and redeemed them through Aave V3 for approximately 1,783 wstETH (~$6 million).

4 October 2026

At 09:21 UTC, Blockaid flagged the ongoing exploit; approximately $2.02 million had already been drained at time of detection.

4 October 2026

At 09:56 UTC, PeckShield confirmed the total loss of 1,783 wstETH (~$6 million). CertiK alerted on the proxy contract at 09:59 UTC. ExVul provided a full breakdown at 10:09 UTC.

4 October 2026

Stolen wstETH reported routed toward Lido's Base-to-Ethereum bridge, which carries a seven-day settlement window before mainnet arrival.

5 October 2026

GoPlus Security and additional security firms disclosed that approximately $31.7 million in assets remained in the vault, still governed by the same compromised multisig. No operator claimed responsibility.

7 October 2026

TokenPost reported that more than 24 hours after the exploit, no team had publicly claimed responsibility or disclosed remediation measures. The vault operator remained anonymous.

9 October 2026

As of this date, no post-mortem, fund recovery, key rotation, or vault freeze has been publicly announced. Vault operator identity remains undisclosed.