Base Chain Vault Contract Hacked, $6 Million Lost

HuoXing Finance reports that on October 5, the GoPlus security team disclosed that a treasury contract on the Base chain, not publicly claimed by the project team, was compromised. The attacker added a malicious contract to the lending whitelist via a Safe multisig and withdrew 1,783 aBaswstETH, redeeming approximately 1,783 wstETH on Aave V3, resulting in losses of around $6 million. The attack stemmed from failures in multisig governance and access control; the project team had not executed any Safe transactions on the treasury contract for 25 days prior to the incident, suggesting possible social engineering or insider collusion. Aave’s core contracts and the Base chain itself were unaffected. As of publication, approximately $31.7 million in assets remain at risk within the compromised treasury.