$6M Vanishes From Crypto Vault Controlled by 7 Mystery Signers

Key Takeaways

• Blockaid and several onchain investigators flagged the Base vault Oct. 4 as losses climbed beyond $6 million.
• Aave converted 1,783 aBaswstETH into wstETH, but its core contracts aren’t blamed.
• Base records point to a 3-of-7 Safe whose owners still haven’t been identified.

The $6 Million Vault Nobody Has Claimed

At 09:21 UTC on Oct. 4, Blockaid spotted what looked like an exploit unfolding on a vault held on Base, Coinbase’s Ethereum layer two (L2) protocol. At that time, about $2.02 million was already gone. Roughly 40 minutes later, the loss had blown past $6 million, with security firms tracing about 1,783 wstETH out of a vault.

Then came the stranger part. No protocol claimed the vault. Its apparent controller is a 3-of-7 Safe whose seven signers remain unidentified, leaving a multimillion-dollar crime scene without a publicly known owner.

Six Outflows, One Freshly Whitelisted Contract

Peckshield, Certik and Exvul converged on roughly the same tally. The security firms said 1,783.067 aBaswstETH was borrowed from the vault and redeemed through Aave on Base into about 1,783 wstETH.

In plain English, the tokens initially taken were Aave receipt tokens representing wrapped staked ether deposited on the L2 Base. A newly created contract was added to the vault’s whitelist, borrowed those receipt tokens, moved them to an attacker-controlled contract and redeemed them through Aave for the underlying wstETH.