An initial estimate of roughly $2 million rose above $6 million the same day. How the attacker obtained permission to access the vault remains unresolved.
More than $6 million was drained from an unnamed crypto vault operating on Base, according to Blockaid. The security firm’s October 4, 2026 alert identified a newly whitelisted contract as the route used to access the funds. Its loss estimate increased after the initial report.
The first alert, posted at 09:20 UTC, put the outflow at roughly $2.02 million across about four transactions. An update at 09:57 UTC said it had exceeded $6 million. These are estimates at different points in the same incident, not losses from two separate attacks.
“it is already more than $6M”
A newly approved contract opened the route out
In Blockaid’s account, the new contract borrowed aBaswstETH from the vault and sent the tokens to the attacker’s contract. A whitelist restricts which addresses may perform certain operations against a vault. The unresolved issue is how the newly added address obtained that permission.
The firm also shared addresses it associated with the attacker and a transaction record on BaseScan. That record shows a successful contract call at 08:53:51 UTC on October 4. It does not, by itself, establish the full loss or identify the people who granted permission. The dollar estimate comes from Blockaid’s incident tracking.
Scope of the incident: The reviewed alerts concern a particular vault. They do not establish that the Base network was compromised or that Aave’s core lending contracts contained a vulnerability. Those sources do not yet provide a conclusive explanation of why access was granted.
The token name does not identify where security failed
aBaswstETH is the aToken representing a wstETH position in Aave on Base. Aave’s documentation explains that aTokens represent supplied assets and accrued yield. They can be transferred and used to redeem the corresponding underlying asset. They are therefore more than a receipt with no value of its own: moving the token also moves an economic claim.
The underlying wstETH is a wrapped version of Lido’s stETH. As Lido’s technical documentation explains, the number of wstETH tokens in a wallet does not change with every rewards update; the amount of stETH each token represents changes instead. ETH, wstETH and aBaswstETH are not interchangeable units. Treating them as identical quantities or applying the wrong market price can distort a loss calculation.
The vault’s operator, the failure in its authorisation process and any recoverable funds remain key questions. Blockaid’s statement that the attack was ongoing describes the time of its update, not confirmation that the same activity continued hours later. For readers following crypto security news, a verified incident report would add more than another repetition of the preliminary loss estimate.
Blockaid’s loss update, October 4, 2026 at 09:57 UTC
The post loads from X when you open it.
