Base vault drained of $6M in Aave deposit tokens after whitelist change

A DeFi vault on Base lost approximately 1,783 wstETH, valued at around $6 million, on October 4, 2026. The cause was not a clever smart contract bug. It was a change to the vault’s own guest list. Someone added a malicious contract to the vault’s borrower whitelist. That contract then walked out with Aave deposit tokens. No protocol has yet stepped forward to say the vault belongs to it, which makes the incident awkward to assign blame for. How the drain unfolded On October 4, two whitelist changes landed between 08:52 and 08:53 UTC. Both were authorized by the same signers, and both happened within a single minute. The net effect was that a malicious contract earned a spot on the list of approved borrowers. With that access, the contract borrowed aBaswstETH from the vault. That token is an interest-bearing receipt: proof that someone deposited wstETH into Aave on Base. Holding the receipt means you can redeem it for the underlying asset. The contract passed those receipts to an attacker address, 0x0B5126e1bc27C0de77e02e97945760A674EdB034. The tokens were then redeemed through Aave for wstETH, the wrapped version of Lido’s staked ether. Six outflows hit the vault, at 0xD1895f2019c2...