Mysterious Safe Controller Vanishes $6M from Base Vault
A $6 million heist has shaken the crypto community, with a mysterious Safe controller holding the key to the vault's contents. On October 4, at 09:21 UTC, Blockaid detected an exploit unfolding on a Base vault, controlled by a 3-of-7 Safe with seven unidentified signers. The initial loss was $2.02 million, but within 40 minutes, the total loss had exceeded $6 million.
The security firms Peckshield, Certik, and Exvul investigated the incident and found that 1,783.067 aBaswstETH tokens were borrowed from the vault and redeemed through Aave on Base into approximately 1,783 wstETH. The tokens taken were Aave receipt tokens representing wrapped staked ether deposited on the L2 Base.
The vault in question is an Openzeppelin transparent proxy, with its owner pointing to a Safe created 324 days ago. The Safe requires three of seven signatures to act, but none of the seven signer addresses has been publicly identified. The operating owner visible onchain is the anonymous 3-of-7 Safe, while its Safe owner is a Safeproxy created through Safe Proxy Factory 1.4.1.
The incident has sparked concerns about the security of the Base protocol, with the potential for near-term pressure on the wstETH peg. However, the systemic risk appears contained for now, and investigators are still trying to determine the cause of the exploit.