$6M Drained from Base DeFi Vault via Whitelist Exploit

A Base DeFi vault has suffered a significant loss of over $6 million after an attacker exploited its whitelist mechanism. The incident occurred on October 4, with blockchain security firm Blockaid first detecting the exploit and estimating losses at around $2.02 million.

The attacker added a new contract to the vault's whitelist, which allowed them to borrow aBaswstETH from the vault and transfer the resulting aTokens into an attacker-controlled contract.

The total loss estimate has since been raised above $6 million by Blockaid, with Spot On Chain and PeckShield independently tracing 1,783 wstETH worth around $6 million to the suspected attacker's address.