Security breach on Base anonymous vault drains about $6M

A security incident worth about $6 million occurred at an anonymous vault contract on Ethereum layer-two network Base after an access control flaw was exploited. According to a GoPlus security alert, the attacker added a malicious contract to Safe multisig’s loan approval whitelist, then stole 1,783 aBaswstETH and cashed it out into wstETH on Aave V3. GoPlus pointed to either phishing targeting a multisig signer or insider collusion as possible causes. The issue was confirmed not to stem from flaws in either the Aave protocol or Base itself, though the vault still holds about $31.7 million in assets.