Base Vault Hackers Drain $6M in wstETH Through Aave-Linked Exploit

A recent security incident on the Base Ethereum layer-2 network has resulted in the loss of approximately $6 million in wstETH, a wrapped staked Ether token. The attack, which occurred on October 4, 2026, exploited a vulnerability in the vault's access control mechanism, allowing an attacker to gain whitelist access and borrow against the vault's position on Aave V3.

The incident is the fourth Aave-linked exploit on Base within a week, raising concerns about systemic risk in the decentralized finance (DeFi) space. The attacker's path involved borrowing against the vault's collateral, followed by redemption of the aTokens into wstETH, which were then moved to an attacker-controlled address.

The victim vault, which holds large Aave V3 positions on Base, has been identified as a managed vault or yield strategy built on top of Aave. However, no team or protocol has publicly claimed ownership of the vault, and the incident has sparked calls for stricter governance on decentralized finance contracts.

The attack highlights the importance of robust access control mechanisms and multisignature wallet approvals in preventing such incidents. The incident is currently being investigated, and a full account will depend on the vault's operator identifying itself and explaining how a contract it had just removed from its whitelist was approved again within a minute.