Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingThe Base network vault was hacked and about US$6 million in wstETH was stolen.
On-line data shows that on October 4, 2026, a vault deployed on the Base network was attacked, resulting in the transfer of approximately US$6 million (i.e. 1,783 wstETH). The exploit involved manipulation of Safe's multi-signature white list, allowing attackers to redirect treasury funds to addresses they control.
At the time of writing, no official statement has been issued by any team or agreement related to the attacked vault, so key details about the vault operators have not yet been confirmed.
Technical Details and Background Analysis
Based on transaction data recorded on blockchain browsers, the attacker exploited a vulnerability in the vault Safe multi-signature whitelist configuration. By manipulating a list of addresses authorized to interact with treasury funds, the attacker successfully transferred the wstETH he held to an address under his control.
Safe (formerly Gnosis Safe) is one of the most widely used multi-signature wallet infrastructures in the decentralized finance (DeFi) space. The whitelist-based access control mechanism based on it is often adopted by vaults and treasury to limit which addresses can trigger the flow of funds.
Such whitelist manipulation vulnerabilities usually stem from two aspects: first, the smart contract that manages address addition or deletion logic is flawed; and second, the signature key needed to approve whitelist changes is leaked. Due to the lack of an official statement, it is unclear whether it was a contract-level loophole or a key leak that led to the whitelist being tampered with in this incident.
Asset Value and Industry Impact
wstETH (Packaged Pledged Ethereum) is a liquid staking derivative that allows the holder to earn Ethereum Pledge rewards while retaining transferable tokens and can be used in other DeFi scenarios, such as collateral in lending agreements and vaults. Losses denominated in wstETH are economically equivalent to losing underlying pledged Ethereum positions, so the severity of this incident is comparable to a direct Ethereum theft of the same size.
This incident further confirms a series of vulnerability exploitation trends in the decentralized finance sector in 2026: the attack targets specifically target multi-signature and access control infrastructure, rather than just smart contract logic errors in lending or transaction agreements themselves. Security researchers are increasingly emphasizing that whitelists and rights management systems are an easily underestimated attack surface. Because once successfully manipulated the authorized address list, an attacker can gain the same vault control as a legitimate, fully authorized signer without having to look for vulnerabilities anywhere else in the protocol code.
