GoldPesa reported an approximately $114,900 loss after an attacker exploited its GPXHooks contract on Base through a flaw in the Uniswap v4 hook’s liquidity-rebalancing process. Defimon Alerts previously said the attacker borrowed 175,000 USDC from Morpho, created an unpaid WETH/USDC position and triggered a rebalance. SlowMist highlighted issues in the GPXHooks reBalance() function and said its shared PositionManager failed to validate currency deltas, allowing positions to be minted without adequate checks. The hook’s liquidity was burned for about 148,900 USDC, while netting within the same PoolManager transaction left roughly 33,900 USDC for the hook and enabled the attacker to withdraw about 115,000 USDC. The attacker repaid the Morpho loan, converted remaining funds to USDT and bridged them to Solana and BNB Chain. GoldPesa’s reported trading volume was $0 after the announcement, while broader crypto-market conditions remained mixed. The transaction was confirmed on Base on October 2, 2026, at 1:05:51 PM UTC. The incident followed separate Base-related exploits involving Moonwell and FlashLoopAdapter, which used different mechanisms and were not reported as connected.