L2 vault exploit losses exceed $6M

TLDR

A multisig crypto vault on Base, an Ethereum layer 2 network, has been exploited for more than 6 million dollars in wstETH, with the owner still unknown.

1. A vault on Base lost about 1,783 wstETH, with reports putting total damage above 6 million dollars, while on chain sleuths trace six exploit transactions through Aave.
2. Current evidence points to a misconfigured multisig vault whitelist rather than a direct hack of Base or Aave, limiting systemic risk but highlighting governance gaps in L2 DeFi.
3. Key unknowns include who controls the vault, whether any funds can be recovered, and how quickly stolen wstETH is sold, which could pressure its peg and related collateral positions.

Deep Dive

1. Exploit Details And Scale

Security firms report that a multisig vault on Base was drained of roughly 1,783 wstETH, with losses estimated at more than 6 million dollars in total value. Coverage notes that assets were borrowed from the vault as aBaswstETH, then redeemed through Aave on Base into wstETH in a series of transactions, pushing reported losses from about 2 million dollars to over 6 million in under an hour. The vault is controlled by a Safe multisig requiring three of seven signatures, but the seven signer addresses and any protocol or organization behind them have not been publicly claimed, leaving a large, anonymous crime scene.

Confidence: high, based on converging reports from multiple security teams and news outlets.

2. What Was And Was Not Hacked

Reports on the incident stress that Base itself and Aaves core lending contracts are not identified as compromised; the weakness appears to sit in the vaults own authorization logic. Investigators describe a newly whitelisted contract that could borrow the vaults Aave receipt tokens and move them to an attacker controlled address before redeeming for wstETH. In practice, this looks like a governance or configuration failure in a private multisig vault, not a protocol level bug in the layer 2 or in Aave.

3. Risks And What To Watch

Short term, the main technical risk is how the attacker disposes of the stolen wstETH, since rapid selling into thin liquidity could temporarily pressure its price and any DeFi positions using it as collateral. Longer term, the exploit highlights the danger of large, unlabeled multisig vaults on L2s, where configuration changes such as whitelisting contracts can silently open doors to loss. Important next signals will be whether any owner publicly claims the vault, whether there is an attempt at recovery or negotiation, and whether on chain monitoring shows concentrated selling or complex laundering routes.

Conclusion

This exploit is a reminder that even when major protocols like Base and Aave remain intact, poorly governed private vaults on top of them can still generate multimillion dollar losses. For crypto users, the key takeaway is to pay attention not only to which chain or protocol you use, but also to who controls the multisig and how its permissions are managed, because that is often where the real custody risk sits.