Unnamed Base vault loses about $6 million in exploit, with $31.7 million still in assets

An unnamed vault on Base was exploited for about $6 million, according to Immunefi Head of Security Gonçalo Magalhães, who said the vault still held roughly $31.7 million in assets at the time of the incident. A briefing said the attacker used a Safe multisig wallet to add a malicious contract to the vault’s lending whitelist, then withdrew 1,783 aBaswstETH and swapped it through Aave V3 for about 1,783 wstETH. Magalhães said the issue came from the whitelist design itself: while restricting access to approved addresses appeared safe, any address that made it onto the list could remove assets without posting collateral. He added that the whitelist weakness had been identified the previous week, but researchers did not have a clear disclosure channel. More than 24 hours after the exploit, no team had publicly claimed responsibility for the vault or disclosed any remediation steps.