AAVE
+0.6%Base DeFi Vault Loses $6M After Malicious Whitelist Addition
Image: Crypto BriefingOn October 4, 2026, a Base DeFi vault lost approximately $6 million, equal to 1,783 wstETH, after a malicious contract was added to its borrower whitelist. The stolen aBaswstETH tokens are Aave Base wstETH deposit receipts, separate from Aave's core lending infrastructure. The vault is governed by a 3-of-7 Safe multisig, with two whitelist changes occurring within a one-minute window that day. No protocol has claimed ownership of the unidentified vault, which still holds roughly $31.7 million in assets.
Key points
- The exploit occurred after a malicious contract was added to the vault's borrower whitelist.
- The stolen aBaswstETH tokens are Aave Base wstETH deposit receipts, separate from Aave's core infrastructure.
- No protocol has claimed ownership of the unidentified affected vault.
Why it matters
The incident highlights risks associated with whitelist access controls and multisig governance for DeFi vaults. It also confirms that breaches of vaults built on Aave do not impact Aave's core lending infrastructure.
What's unclear
The identity of the affected vault and its affiliated protocol has not been confirmed
No official post-mortem has determined the root cause of the whitelist compromise
Price context · AAVE
At publication
$181.69
Now
$131.00
Change since
−27.90%
7 days
Sources · 2 publishers
Crypto Briefing
Tier 2
Base vault drained of $6M in Aave deposit tokens after whitelist change
Coverage timeline
- First reported by Blockonomi
- Also reported by Crypto Briefing
- CryptoVideos brief published
How this page is checked. AI drafted this brief from selected independent reports. Automated checks compare numbers, source coverage and topic terms, but may miss errors. Publication and evidence refreshes run automatically. Read the linked reports for context. Report an error
