A vault on Base, Coinbase’s Ethereum layer two (L2) protocol, lost more than $6 million after a newly created contract was added to its whitelist. Investigators said about 1,783.067 aBaswstETH was borrowed, transferred to an attacker-controlled contract and redeemed through Aave on Base for roughly 1,783 wstETH. The vault is controlled by a 3-of-7 Safe whose seven signer addresses and underlying organization have not been publicly identified. Security firms have not confirmed a core-contract compromise, a Base chain hack or the precise authorization failure. The stolen wstETH could face near-term selling pressure, but systemic risk appears contained for now. The incident remains under investigation, and no protocol has claimed the vault.