Base wstETH vault allowlist drain — attacker addresses (~$6M)
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Reported: 2026-10-14
- Last updated: 2026-10-16
On 2026-10-04 an unidentified vault on Base lost about 1,783.067 aBaswstETH (~$6M) after its 3-of-7 Safe allowlisted an attacker contract that withdrew the vault's Aave V3 position. PeckShieldAlert labeled 0x0B5126…B034 as the draining address (https://x.com/PeckShieldAlert/status/2106684818654482531). Blackpaper BP-1315 (https://blackpaper.wiki/incident/BP-1315/) and 0xCERT-2026-0230 (https://www.0xcert.com/advisory/0xCERT-2026-0230) name the same attacker EOA and the exploit contract added to the vault borrow allowlist. Also covered by PublicAML (https://publicaml.org/base-vault-hack/).…
Other addresses in this report: 0x0b5126e1bc27c0de77e02e97945760a674edb034, 0xcdfe91301356da873562ef513828a60dba1f569d, 0xc73448432a05deea5ea18a07d3b5d9ccf6297f8d