On Base, the attack drained 1,783.067 aBaswstETH from the vault at 0xD189…FCABC through a newly whitelisted proxy, then redeemed it through Aave into about 1,783.067 wstETH. The six vault outflows and redemption are visible in the attack transaction and wstETH redemption. The available evidence points to abuse of the vault’s whitelist and borrowing path; it does not identify how the attacker obtained whitelist authority. Reports describe the loss as roughly $6 million. PeckShield and the transaction trace

Oct 4, 2026, 11:55 UTC

On Base, the attack drained 1,783.067 aBaswstETH from the vault at 0xD189…FCABC through a newly whitelisted proxy, then redeemed it through Aave into about 1,783.067 wstETH. The six vault outflows and redemption are visible in the attack transaction and wstETH redemption. The available evidence points to abuse of the vault’s whitelist and borrowing path; it does not identify how the attacker obtained whitelist authority. Reports describe the loss as roughly $6 million. PeckShield and the transaction trace

The attacker sent 1,782.067 wstETH to 0xC734…7f8D. That wallet later submitted a Base Bridge withdrawal proof on Ethereum, but the seven-day route had not yet produced an Ethereum wstETH transfer in the evidence available. Base transfer · withdrawal proof

Risk

a sale could put temporary pressure on wstETH and related LST markets, especially where liquidity is shallow. The observed Base wstETH/WETH pool had about $3.9 million in reserves, versus roughly $6 million of stolen wstETH; current quotes showed wstETH near 1.245 WETH, with no clear discount in the supplied market snapshot. That makes a large Base-side sale potentially disruptive locally, but does not establish broad contagion to ETH or other LSTs. Pool data

The evidence establishes the token flows and bridge proof, but not the attacker’s route to whitelist authority or the eventual disposition of the bridged funds.

Ask your own

Case file

Answered Oct 4, 2026, 11:55 UTC

Sources 8

0xD189…FCABCbasescan.org
attack transactionbasescan.org
wstETH redemptionbasescan.org
PeckShieldx.com
0xC734…7f8Dbasescan.org
Base transferbasescan.org
withdrawal proofetherscan.io
Pool databasescan.org

Research trace 29

The supplied post gives only a shortened suspected attacker address, so first retrieve the full post and its cited details to identify the exact address. That is needed before attribution and transfer tracing.
The initial post confirms the 1,783 wstETH report but gives only a shortened address. Search for the complete address and an attack transaction so the funds can be attributed and traced on Base.
The reports now describe the route through a whitelisted vault and identify a possible destination, but only shortened wallet addresses are available. Find a source that exposes the full attacker and recipient addresses so they can be attributed and traced on Base.
The reports identify the suspected attacker and recipient only by shortened addresses, so the next check is the post carrying the transfer details and any public report that supplies complete addresses or transaction hashes. Those identifiers are needed before labeling wallets or tracing funds on Base.
The reports give only shortened attacker and recipient addresses, which are not enough to trace funds. A search for the full Base addresses or transaction hashes is needed before attribution and on-chain verification.
The report now gives the full suspected attacker address, but the earlier evidence does not establish who controls it or name the vault completely. Attribute the attacker first; that label will guide the next on-chain tracing step.
The previous findings provide a full suspected attacker address and one reported attack transaction, but not on-chain confirmation or the victim vault’s full address. Check the attacker’s Base label and the transaction’s receipt and details to identify the token contracts and counterparties for tracing.
The prior receipt identifies the suspected attacker, the vault, an intermediary contract, and the wstETH token contract, but not their labels or the full amount drained. Label these addresses first; then their roles can guide transfer tracing.
The receipt confirms one Aave Base wstETH-token outflow, but does not establish the total amount or where the extracted tokens went. Check labels for the vault and intermediary, identify the relevant token contracts, and search for later reports with transaction details to guide the next transfer trace.
The vault and Aave aToken are identified, but the reported total outflow and redemption path still need on-chain confirmation. Read the vault’s aBaswstETH transfers around the attack, the attacker’s aToken receipts and wstETH receipts, and attribute the intermediary and destination addresses before tracing further.
Earlier findings identify the vault, attacker, Aave aToken and an initial attack transaction, but do not establish the total transfers or where the wstETH went. Check the vault’s aToken outflows and the attacker’s token receipts, and retrieve the fuller incident report to clarify the route.
The prior logs confirm six vault outflows totaling 1,783.067 aBaswstETH and a matching wstETH redemption to the suspected attacker. Check the attacker’s current wstETH movements and balance to determine whether the assets remain exposed to a possible sale or were routed elsewhere.
The attacker sent 1,782.067 wstETH to a second address and 1 wstETH separately. Identify both destinations before checking their current balances and transfers to determine whether the main amount was sold or remains there.
The reported 1,782.067 wstETH transfer went to a second wallet, while a separate 1 wstETH went to another address. Attribute both destinations before tracing their token transfers to determine how much remains and whether it was sold.
The two recipient wallets have no known Arkham labels, and the last checks only established that their native-ETH balances are small. Read their Base wstETH transfers to see whether the stolen tokens remain there, moved again, or entered a bridge or market.
The earlier transfer trace shows the attacker sent 1,782.067 wstETH to an unlabeled wallet, while the other destination received no positive wstETH transfer. Check the recipient’s wstETH balance and cross-chain movement to establish whether the bulk remains exposed to a sale or has moved off Base.
The on-chain trace already confirms the vault drained 1,783.067 aBaswstETH and that 1,782.067 wstETH was later sent to a second wallet; the recipient balance indicates the bulk remains there. Check current reports and chain evidence for any later sale, recovery, or other LST market impact so the risk assessment reflects developments beyond the initial alerts.
The last check found no later Base wstETH transfers from the main recipient, but it did not establish whether the incident was contained or whether LST prices moved. Look for post-alert protocol statements and market evidence to assess recovery and the claimed short-term risk.
The trace confirms a permissions-path drain and that the stolen wstETH was consolidated in an unlabeled wallet, with no later Base transfer in the checked window. This step seeks the vault and Aave token labels, pool depth for Base wstETH, and protocol or issuer statements that could qualify the claimed scope and LST risk.
The last checks indicate the stolen wstETH is still held in the recipient wallet, while the initial reports leave the victim vault’s protocol identity and authorization failure unclear. Look for newer incident details and a clearer vault identification, and compare current LST market data to assess whether the reported risk is showing up in prices.
The known trace shows 1,782.067 wstETH moved to a second wallet. This step checks for later token movement, identifies the recipient, and compares current wstETH liquidity and LST prices to assess sale and peg pressure.
The traced funds remain at an unlabeled recipient wallet on Base, and current pool data show wstETH near its quoted ETH value. Check the recipient’s recent activity and current wstETH and stETH market quotes for any movement or visible LST price dislocation.
The previous findings show that 1,782.067 wstETH was bridged from Base toward Ethereum, while its destination-side disposition remains unresolved. This step checks the bridge proof transaction and for later incident reports that could clarify whether the funds moved or the LST risk changed.
The Base recipient submitted a withdrawal proof to the Base Bridge on Ethereum, but that does not show whether the bridge released the wstETH or where it went. Identify the address named in the bridge event before tracing its token transfers and checking for newer incident updates.
The Ethereum Base Bridge proof shows the withdrawal path was initiated, but not whether it was finalized or the wstETH delivered. Check bridge events and the attacker recipient’s Ethereum wstETH transfers and balance, alongside newer incident reporting and current stETH pricing.
The prior trace shows a Base Bridge withdrawal proof was submitted, but the recipient’s Ethereum wstETH balance is zero. Check for a matching bridge event or later wallet activity, and compare current wstETH and other LST prices for signs of a visible discount.
The supplied trace establishes the Base-side drain and a withdrawal proof, but not whether the Ethereum withdrawal has completed or where the wstETH went. Check the bridge withdrawal finalization and the associated L1 token movement to assess the remaining sale risk.
The bridge proof was submitted, but the seven-day withdrawal window means it does not establish that wstETH reached Ethereum. Check for newer incident updates and compare current prices of major LSTs with ETH to see whether the reported sale risk has produced a visible discount.
The Base-side wallet submitted a withdrawal proof, but the seven-day bridge delay means the bulk wstETH has not yet been shown to arrive on Ethereum. Check whether the attacker sold or moved wstETH elsewhere on Base, and whether the market data indicate any visible short-term LST pressure.