$114,000 Drained from GoldPesa's GPXHooks Contract on Base

A recent exploit on Base has drained $114,000 from GoldPesa's GPXHooks contract. According to security monitoring account Defimon Alerts, the attacker borrowed 175,000 USDC from Morpho and created a WETH/USDC liquidity position. The attacker then triggered the GPXHooks contract's rebalancing process, causing funds from GoldPesa's liquidity position to offset the attacker's outstanding debt. As a result, the hook allegedly received only $33,900, with the remaining funds covering the attacker's position. The attacker then burned the position to withdraw roughly 115,000 USDC, repaid the Morpho loan, and converted the remaining funds into USDT. The transaction was confirmed on Base on October 2, 2026, at 1:05:51 PM UTC. The GPXHooks contract's rebalancing process interacted with outstanding balances in the PositionManager, allowing the attacker to exploit the vulnerability. Defimon identified the issue as a logic error involving the Uniswap v4 hook and the liquidity-rebalancing process. GoldPesa has not commented on the incident yet. This is the second recent exploit on Base, following a $305,000 drain from the FlashLoopAdapter on October 2, 2026. Other projects on Base have also been targeted, including Moonwell, which lost nearly $8.7 million in an exploit on August 27, 2026. The incidents involve different attack mechanisms and are not reported to be connected to the GoldPesa exploit. Defimon's October 3 post did not include a statement from GoldPesa on the alleged exploit. The information researched and reported by The Crypto Times is for informational purposes only and is not a substitute for professional financial advice. Investing in crypto assets involves significant risk due to market volatility. Always Do Your Own Research (DYOR) and consult with a qualified Financial Advisor before making any investment decisions.