Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingSummary: Damage estimates climb as attacks continue
Evidence shows that core Aave and Base systems have not been affected. A DeFi vault running on Base lost more than $6 million after attackers whitelisted new contracts and drained assets.
Incident history and loss estimate
Blockaid, a blockchain security company, first reported the exploitation of an unnamed vault on Base on October 4. At that time, it was estimated that approximately US$2.02 million was stolen through about four transactions. However, as the explosions continued, Blockaid subsequently raised its damage estimate to more than $6 million and said the attack was still in progress.
Spot On Chain and PeckShield both traced approximately 1,783 wstETH pieces that were transferred to the attacker address 0x0B5126…B034. There is currently no public evidence that Aave or Base's core systems have been compromised, and the root cause of the vault vulnerability has not yet been confirmed.
Authorization control becomes focus
The core of this incident lies in the treasury's authorization control mechanism. According to Blockaid, the attacker added a newly created contract to the whitelist, lent aBaswstETH from the vault, and transferred the resulting aTokens into a contract controlled by the attacker. Typically, the whitelist is intended to limit interactions to approved contracts or addresses, but in this case, a newly created contract was approved before the lending activity began.
调查人员尚未确定该新合约是如何获得授权的。目前没有证据表明这种批准是由于管理密钥问题、配置错误、访问控制功能缺陷还是智能合约漏洞所致。虽然被盗资产涉及Aave流动性基础设施，但现有证据并未显示Aave的核心借贷合约受到损害。
对系统和市场的影响有限
aTokens是当资产存入Aave市场时发行的生息代币，代表存入的资产及应计收益。这一区分使得关注点集中在未识别金库的授权控制上，而非Aave的借贷基础设施。Spot On Chain指出，更广泛系统性风险似乎有限，尽管出售被盗的wstETH可能会造成短期市场压力。
wstETH是Lido的stETH非复利版本，其余额不会像stETH那样随质押奖励累积而增加，而是通过与stETH的汇率随时间变化来体现价值。Base是基于OP Stack构建的以太坊Layer 2网络。目前没有迹象表明底层网络本身受到侵害。
受影响的金库身份尚未查明，且官方尚未发布事故调查报告以确立漏洞的根本原因。因此，随着调查人员追踪交易，这600万美元的损失估算仍可能发生变化。
