L2s hit by $6M Base vault hack

TLDR

A vault on Base, an Ethereum layer 2, was exploited for about $6 million in wstETH, but the Base network and Aave themselves were not directly hacked.

1. The incident involved a 3-of-7 Safe-controlled vault on Base, where an attacker whitelisted a new contract, borrowed aBaswstETH, and redeemed it for roughly 1,783 wstETH.
2. Current evidence points to a failure in the vaults authorization or whitelist controls, with no confirmed compromise of Base or Aave core contracts, so systemic L2 risk looks limited.
3. The key things to watch are where the stolen wstETH moves, whether the anonymous vault operators disclose more, and whether L2 apps tighten multisig and whitelist security.

Deep Dive

1. How The Base Vault Was Drained

Reports say a multisig vault on Base lost more than $6 million on 4 Oct when about 1,783 wstETH left the wallet in a targeted exploit. A detailed trace describes an attacker adding a newly created contract to the vault whitelist, borrowing Aave receipt tokens aBaswstETH from the vault, then redeeming them through Aave on Base for wstETH, with losses first flagged around $2 million before climbing to about $6 million in six transactions. The vault is an OpenZeppelin proxy owned by a 3-of-7 Safe, whose seven signers have not been publicly identified, and the exact authorization weakness that allowed the whitelist change is still unconfirmed, according to coverage such as the Base vault attack drives reported losses to about $6 million and 6M vanishes from crypto vault.

2. Impact On L2s And DeFi Risk

Security firms and reporters consistently note that Base itself and Aaves core contracts have not been identified as hacked, so this is an application level vault failure on an L2 rather than a protocol level exploit of the L2 stack. Systemic risk is described as contained, though selling or moving the stolen wstETH could put short term pressure on its peg and on liquidity in the affected pools on Base and other networks that hold wstETH. The more important signal for crypto users is that complex multisig vaults and whitelisting logic on L2s can become single points of failure if permissions and signer security are not rigorously audited.

3. What To Watch Next

Near term, the critical onchain signal is how the attacker routes and potentially sells the roughly 1,783 wstETH, including any attempts to move across bridges or into privacy pools. Off chain, the market is waiting to see whether the anonymous Safe signers or any associated protocol publicly claim the vault, explain whether credentials, upgrade keys, or permission logic failed, and outline recovery or compensation if users were affected. For the broader L2 ecosystem, this incident is likely to prompt more scrutiny of multisig configurations, upgrade paths, whitelisting mechanisms, and monitoring tools on Base and other L2s that rely on similar vault patterns.

Conclusion

The $6 million Base vault exploit highlights that the main risk in L2 ecosystems often lies in how smart contract vaults and multisigs are configured, rather than in the L2 protocol itself. If investigators confirm an authorization or whitelist flaw, it should accelerate audits and hardened operational practices across L2 DeFi, which in turn can reduce the chance that a single misconfigured vault becomes a cross network contagion point.