从Base金库中提取600万美元：现在你可以如何利用你的DeFi存款

In-depth analysis of the theft of the Base layer investment vault on October 4: Rights management loopholes and German investors 'coping strategies

On Sunday, October 4, 2026, an investment vault on the Base of the Ethereum Layer 2 network was cleared, losing approximately 1,783 wstETH. Based on October 5 prices, the value is approximately $6 million. The key to this incident is not a loophole in the protocol code, but a fatal flaw in the "whitelist" rights management: the attacker added a newly deployed contract to the treasury whitelist, lent interest-bearing deposits through the contract, and exchanged them for Ether derivatives in Aave V3.

For German investors, this is not a distant agreement accident. Anyone who deposits funds in a vault, income product, or lending strategy relies on the authority structure that is invalid here. This article will sort out the incident, point out the missing links in control, and clarify how German investors should review their own allocation.

What happened on the morning of October 4: The 1,783 wstETH

missing early Sunday morning began in the early morning of October 4. At 08:52 UTC, the vault owner's Safe Multisign Wallet removed a contract belonging to the attacker from the whitelist. One minute later, at 08:53 UTC, the same contract was whitelisted again. Both transactions carry valid signatures from existing signers.

At 09:20 UTC, the security company monitoring activity on the chain gave a preliminary estimate of US$2.02 million in damage. As the outflow continued, total losses in the morning grew to approximately $6 million. In the end, 1,783 wstETH pieces fell into the hands of the attacker and were transferred to an address under his control.

我们可以进行简单的算术验证：10月5日wstETH报价约为3,386美元，Ether本身约为2,720美元。按1,783枚单位计算，总额约为600万美元。报道中的数据在600万至610万美元之间波动，取决于所使用的具体价格时刻。数据并未被平滑处理：金额随价格波动而变化，而价格是动态的。

多家安全公司同时监控并分析了这一序列，包括Blockaid、PeckShield、CertiK和ExVul。正是因为这种同步性，即使金库运营方未发布声明，该事件也能以分钟为单位被详细记录。

白名单作为入口：新合约如何接触到资金

白名单是协议允许执行特定操作的地址或合约列表。不在列表上的内容将被拒绝。只要有一个条件成立，这种方法就被视为稳固：即有权更改列表的人必须是同一方。

这正是攻击切入的点。攻击者无需绕过计算规则，也无需找到Aave代码中的弱点。他们只需要在白名单上获得一个借用位置。一旦获得该位置，其合约在系统看来就与其他已批准的合约无异。

协议缺陷与权限缺陷的区别

当合约的计算逻辑出现算术错误（例如价格计算或利息公式错误）时，称为协议缺陷。当逻辑正确但错误的实体被允许操作时，称为权限缺陷。Base金库属于后者，这对存款人来说更为棘手：确认计算逻辑无误的审计，并不能说明权限列表是如何管理的。

另一个在多个分析中出现的细节是：在10月4日之前，金库的Safe钱包已有约25天未触发任何交易。一个存放数百万资金的容器数周无动静，当突然有交易出现时，往往无人察觉。

UTC时间08:52和08:53：Safe多签内部的逐分钟序列

这两笔白名单交易的短暂过程是整个事件中最奇怪的部分。移除后仅六十秒便重新接纳，这看起来不像操作失误。该序列更像是一个有人故意设定审批顺序的过程。

分析公司认为有两种可能的解释，且均以可能性而非结论表述：要么是现有签名者的密钥落入他人之手，要么是审批路径本身被操纵，导致签名者确认了与其认知不同的内容。究竟是哪一种尚不清楚。运营方未发布任何声明。

唯一可以确定的技术事实是：签名在密码学上是有效的。因此，对区块链而言，对权限列表的更改是合规操作。没有违反任何规则，也没有人可以根据签名拒绝它。

Effective ECDSA signatures: What can and cannot do with 3-of-7 multi-signature [TAG_3/7]

According to on-chain analysis, the vault uses a Safe multi-signature wallet with a threshold of 3/7. The multi-signature wallet requires the set minimum number of signatures to perform the operation. 3/7 means that any three of the seven storage keys can be used for each approval.

This design protects against the loss of a single key. If a key fails, the wallet can still be used. But it provides little protection against another risk: Anyone who simultaneously holds three-sevenths of the key has full control. Since the identities of the seven signers are not known to the public, it is impossible to even judge the degree of independence between the seven signers from the outside.

Why the threshold itself is not enough to explain the problem

The strength of multiple signatures depends on the distribution of keys. Seven keys are distributed in seven locations, which is a completely different situation from seven keys being placed on two devices in the office. From the outside, the two are the same: only thresholds are displayed on the chain, but no distribution is displayed. If you set up multiple signatures yourself, distribution is the part that comes into play; our Multi-Signature Wallet Setup Guide explains this in detail.

The second point concerns delay. Many protocols set a locking period (time lock) between a permission change and its effectiveness. Changes to the permission list only take effect after 24 or 48 hours. In the Base Treasury case, there is no such period between approval and outflow. If such a mechanism exists, the other party will have hours rather than seconds to respond.

对于你的持仓而言，这意味着：此类容器之外的托管由你独自决定。涉及哪些设备及其成本，请参阅我们的硬件钱包对比。

Aave V3与Base链：为何这是访问控制失败

Aave的核心合约或Base网络本身均未受到损害。在整个事件中，两者均按预期工作。攻击者将Aave V3用作支付柜台：他们借出计息存款并将其在那里交换为wstETH，这是任何已批准合约都被允许的操作。

这一区别对评估至关重要，且在快速报道中常被混淆。对Aave的攻击会影响协议的每个用户。而此处发生的事件仅影响单个金库及其存款人。这并不意味着受影响者的损失变小，但它改变了投资者需要提出的问题。关键在于谁控制你存入资金的容器，其次才是背后大型协议的安全性。

分析师称金库内仍有资金

根据链上分析，流出后金库内仍保留着八位数美元的资金，处于与流出部分相同的权限结构下。引用的数字约为3,170万美元。由于运营方未发表评论且未宣布恢复措施，该数字仅为外部估计。根据开发者社区的观察，部分收益已通过Lido基础设施桥接至以太坊；这也仅是观察，而非确证的归属。

wstETH、aBaswstETH和Lido：本案中的代币包装解释

此事件中出现了三个名称，它们层层递进。区分它们有助于理解为何流出需要两个步骤：

• stETH：是对质押给Lido的Ether的索取权。
• wstETH：是其包装版本，单位数量固定；收益反映在价格中而非数量中。
• aBaswstETH：最终，这是在Base上存入Aave并赚取利息的wstETH的索取权。

攻击者借出了第三种形式，并将其赎回为第二种。每种包装均可交易，且各自携带自身风险：包装可能失去与基础资产的挂钩，而位于另一链上的包装还取决于将其带往那里的桥梁。任何通过这些堆栈产生收益的人都应在查看百分比之前先计算层级。

无运营商的金库：匿名发行商对存款人的意义

此案最引人注目的点不在技术层面。在首次分析报告发布之前，没有任何协议声称该金库，也没有任何一方宣布恢复。因此，这里有数百万资金、一个拥有七名未知签名者的多签钱包，而受害者无处可寻。

For German investors, this is a decisive legal difference from everything regulated by EU MiCA regulations since January 1, 2026. Authorized crypto asset service providers have registered offices, regulatory bodies and a complaint address. A vault without a named publisher does not have these conditions. Authorized service providers in Germany can be consulted in BaFin's company database. Many readers are familiar with the whitelist component from the user side: the whitelist for withdrawals in your own exchange account is based on the same philosophy, except that there you decide for yourself who is on it.

Revenue and counterparty risk: Differences between DeFi treasury and licensed providers

Treasury typically promises higher returns than pledged quotes from regulated providers. This premium is not a gift. It is the price for depositors to bear the risks: the risk of authority structures, the risk of bridging, and the risk of not being able to reach operators in suspicious circumstances.

At regulated providers, the risk lies elsewhere. You take counterparty risk against well-known companies, but with authorization, reporting obligations, and complaint channels. Which version is more appropriate depends on how much you can check and how much you are willing to check. Regulated routes to pledged proceeds typically pay less, but are backed by well-known companies.

Cases fit this year's pattern

According to industry statistics, more than $766 million disappeared from exchanges, bridges and DeFi protocols in September 2026, setting the highest monthly figure this year. In this year's larger event, the main reason was keys and permissions, followed by the calculation logic of the contract. On October 2, two days before the Base vault, two Safe multi-signings that had enabled the recurring module around Aave v3 were hit, resulting in a flow of 114.09 ETH; similarly, the core pool was not affected, and the fault was also the auxiliary contract with too wide authority.

Tax stance on treasury outflow losses: German perspective

In terms of taxation, theft of cryptocurrency in Germany is not a clearly defined case. Under current law, the sale triggers a private disposal under Section 23 of the Income Tax Act. Outflows through third-party access are not sales, so incidents that may attach losses are missing.

In practice, this means that anyone wishing to declare such losses needs to have a record. These records include a transaction hash of the deposit, a proof of the time of outflow, a vault address, and a document of your own acquisition costs. Whether the Inland Revenue Department acknowledges losses is a case-by-case decision; there is no general guarantee. Anyone with significant impact should resolve the matter with a tax adviser rather than relying on articles.

What can you record while the data on the chain is still visible

Blockchain data will not disappear, but the analysis service will change the way it is displayed and the provider will close the interface. Affected persons should immediately save transaction records and account statements to files, rather than relying on the service's interface. This will only take half an hour and will not be compensated later.

Base vault hacking incident: Key points in your decision-making

Find out who holds the rights to your container.

For any product that holds funds, the questions are the same: Who can change the permission list, how many signers are needed, and whether there is a lock-up period between the change and its effectiveness? If you can't find the answer, the answer is "non-existent." For the parts you want to own, our software wallet comparison helps classify them.

Separate earnings balances from positions.

Things that remain immovable for a long time do not belong to containers that have other people's rights structures. Anyone who generates a return through borrowing will find a regulated route in lending comparisons; they usually pay less, but are backed by well-known companies.

Keep your purchase trajectory traceable.

Any tax classification, including loss events, requires time and acquisition costs. Providers authorized in Germany and providing clear records are listed in our overview of cryptocurrency exchanges.

Currently, Base vault is still a case without a sender. In any case, the useful information it shows is that the question of how secure the agreement is is different from the question of controlling your own funds. No audit can answer the second question; the answer lies in the signer list.

(As of October 5, 2026. This article does not constitute investment advice. Price and fee structures will change; check terms with your provider before purchasing.)