💀 $6M walked out of a Base vault — and suddenly nobody owns the thing

On Oct. 4 somebody strolled out of a vault on Base with over $6 million, and here's the punchline: no team, no protocol, no owner has come forward to say the vault was theirs. Blockaid clocked the drain at 09:21 UTC with $2.02M already gone — 40 minutes later the losses blew past $6M. Security firms traced about 1,783 wstETH out of a 3-of-7 Safe whose seven signers still don't have faces.

▪️ Some freshly created contract got whitelisted into the vault. That's the whole trick — no chain hack, no Aave core bug, just a door somebody was allowed to open.
▪️ Through that whitelist the attacker borrowed 1,783.067 aBaswstETH — Aave receipt tokens for wstETH deposited on Base — and shunted them into a contract he controlled.
▪️ Then he redeemed them through Aave on Base for roughly 1,783 wstETH. Exvul counted six separate outflows; Peckshield and Certik landed on the same tally.
▪️ Base itself wasn't hacked and Aave's core contracts aren't taking the blame. The drained vault is an Openzeppelin transparent proxy, and its owner is a Safe created about 324 days ago.
▪️ Vault 0xD1895f2019c2152FC2b9022D57f19198c4CFCABC, owner Safe 0x6b27512a5943Ed327f6cb6C3EC1f0398229f42C4 — a Safeproxy out of Safe Proxy Factory 1.4.1, per Basescan and Arkham.
▪️ Stolen keys, a whitehat, garbage permissions, some unknown weakness — nobody has confirmed which. Upgrade authority sits on a separate layer above that Safe, so the chain of control is longer than it…

📊 Already gone at 09:21 UTC: $2.02M
📊 Traced out of the vault: 1,783 wstETH
📊 Signatures required: 3 of 7
📊 Safe age: 324 days

Here's what actually matters for you: a 3-of-7 Safe with anonymous signers isn't a multisig, it's a promise — and permission layers plus whitelists plus proxy owners are precisely the shape of the risk you're wearing if you're farming Base while parked on receipt-token collateral. Offloading 1,783 wstETH is enough size to lean on the peg, so watch for a wstETH discount the moment that stack starts moving. Nothing has been patched and nothing has been explained, because nobody has even confirmed what broke. The trace is sitting out there in the open — the humans behind it aren't.

🔮 Seven addresses in plain sight, zero humans attached. Whoever owns this will surface the second the trace gets warm.

@exverse_chat