hack or exploit

Base Vault Drained of About $6 Million in Aave Deposit Tokens

0Importance
closedStatus
3News media
3Pieces
Published
Updated
Since then
3 new reports
Also mentions
AAVEETH

A Base vault was drained in a series of token outflows, with the amount described as about $6 million in several updates and about $2.02 million in an earlier one. The transfers included 1,783 wstETH-related tokens and redemptions through Aave V3, and some funds later moved toward Ethereum through bridge withdrawals.

Share on X Share on Telegram Share on Reddit Share on WhatsApp

Key claims & sources

✓
An earlier update said the Base vault attack had drained about $2.02 million across four transactions, and the incident was still ongoing at that point.
Base Vault Attack Drains About $2.02 Million Across Four Transactions
✓
One update said the vault transferred about 1,783 wstETH on Oct. 4, and that its seven signers had not been identified publicly.
Base Vault Loses More Than $6 Million in Exploit
✓
A later report said six outflows followed a borrower-whitelist change, and the proceeds were redeemed for wstETH with some funds later entering bridge withdrawals toward Ethereum.
Base Vault Drained of About $6 Million in Aave Deposit Tokens
✓
Immunefi said the Base vault exploit exposed a disclosure gap, and that about $31.7 million remained in the vault at the time of the incident briefing.
Base vault’s $6M exploit exposes a disclosure gap: Immunefi

What it means

In practice, the incident changed the visible path of the funds: withdrawals were followed by redemptions into wstETH, and some of the proceeds later moved through bridge withdrawals toward Ethereum. That left the vault with a large amount still inside it, while the token movement itself continued to be the observable behavior.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market
first headline
+0.1% 2 h before
+0.9% 4 h after
$2.9Tmarket cap at publication
12data points

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 5 18:44
The Defiant scoop
Breaks the event: $6M
+10 min
Oct 5 18:54
Crypto Briefing context
Its angle: unauthorized, highlights, governance
+1 d 1 h
Oct 6 20:13
crypto.news adds
Adds $31.7M, with quotes

Thefts of a similar size

WhenWhat happenedFigure
2.6 years ago Remilia · Private key compromised incident $6M
3.1 years ago Coins.ph · Private key leakage incident $6M
3.8 years ago LendHub · Incorrect Share Accounting incident $6M
3.8 years ago LendHub · Contract vulnerability incident $6M
4.0 years ago FTX & 3Commas · Phishing attack incident $6M

4282 incidents stored · 467 were as large as this one or larger ($6M)