October 5th 2026, 6:54 PM
Aave Security Breach Exposes DeFi Vulnerabilities
Key Summary
A DeFi vault on Base lost approximately 1,783 wstETH, valued at around $6 million, after a malicious contract was added to the vault's borrower whitelist. The change occurred between 08:52 and 08:53 UTC, with two whitelist changes authorized by the same signers. The malicious contract borrowed aBaswstETH, which was then redeemed for wstETH, and some stolen funds were routed through Lido's Base-to-Ethereum bridge. The vault's 3-of-7 Safe multisig had not executed a transaction in 25 days before the attack, and it remains unclear how the required signatures were obtained. The vault still holds around $31.7 million in assets.
Please see our real time news feed on our Home Page
Incident Details
The incident occurred after a whitelist change on the Aave platform, which allowed unauthorized access to the base vault.Lessons Learned
This incident highlights the critical need for robust security measures and governance protocols in DeFi to prevent unauthorized access and asset loss.The loss of $6M in Aave deposit tokens underscores the importance of robust security protocols in the DeFi ecosystem.
#Aave#DeFi#SecurityBreach#WhitelistChange