Base Vault Drained of About $6 Million in Aave Deposit Tokens

HACK OR EXPLOITBase Vault Drained of About $6Million in Aave Deposit Tokens36IMPORTANCECLOSED3NEWS MEDIA3PIECESOct 4, 2026 09:37blockboard.net

A Base vault was drained in a series of token outflows, with the amount described as about $6 million in several updates and about $2.02 million in an earlier one. The transfers included 1,783 wstETH-related tokens and redemptions through Aave V3, and some funds later moved toward Ethereum through bridge withdrawals.

What this rests on

Claim by claim, with its source
✓
An earlier update said the Base vault attack had drained about $2.02 million across four transactions, and the incident was still ongoing at that point.
✓
One update said the vault transferred about 1,783 wstETH on Oct. 4, and that its seven signers had not been identified publicly.
✓
A later report said six outflows followed a borrower-whitelist change, and the proceeds were redeemed for wstETH with some funds later entering bridge withdrawals toward Ethereum.
✓
Immunefi said the Base vault exploit exposed a disclosure gap, and that about $31.7 million remained in the vault at the time of the incident briefing.

What it means

Who it affects, what changes and what is still unconfirmed

Each sentence links inside to the piece that supports it.

In practice, the incident changed the visible path of the funds: withdrawals were followed by redemptions into wstETH, and some of the proceeds later moved through bridge withdrawals toward Ethereum. That left the vault with a large amount still inside it, while the token movement itself continued to be the observable behavior.

Market reaction

BT Bitcoin market event: it is read against the reference from 2 h before to 4 h after the line marks the first headline
published
+0.17 % before publication
+0.04 % after
$85,154price at publication
12series points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

How the story was built

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 5 18:44
The Defiant scoop
Breaks the event: $6M
+10 min
Oct 5 18:54
Crypto Briefing context
Its angle: unauthorized, governance, highlights
+1 d 1 h
Oct 6 20:13
crypto.news adds
Adds $31.7M, with quotes

Thefts of a similar size

WhenWhat happenedFigure
2.6 years ago Remilia incident $6M
3.0 years ago Coins.ph incident $6M
3.8 years ago LendHub · Incorrect Share Accounting incident $6M
3.8 years ago LendHub incident $6M
4.0 years ago FTX & 3Commas incident $6M

4200 incidents stored · 459 were as large as this one or larger ($6M)