Base DeFi vault loses more than $6 million

• A DeFi vault on Base lost more than $6 million in an ongoing exploit.
• The attacker reportedly added a new contract to the vault’s whitelist.
• Investigators traced about 1,783 wstETH to a suspected attacker address.

A DeFi vault on Base has lost more than $6 million in an ongoing exploit.

Blockaid initially estimated losses at $2.02 million across roughly four transactions.

Blockaid said a new contract was added to the vault’s whitelist before assets were extracted.

The attacker borrowed aBaswstETH before transferring the resulting tokens to an attacker-controlled contract.

Security researchers later linked about 1,783 wstETH to suspected attacker address 0x0B5126…B034.

Investigators have not established how the newly created contract obtained whitelist approval.

The available evidence does not indicate that Aave’s core lending contracts or Base itself were compromised.

The exploit exposes weaknesses in whitelist controls across decentralised finance infrastructure.