On a routine Tuesday, GoPlus disclosed something that should stop every yield-chasing depositor cold. A vault on Base β a lending aggregator holding wrapped staked ETH β was drained of 1,783 aBaswstETH. The attacker redeemed it for 1,783 wstETH through Aave V3 and walked away with roughly $6M. No reentrancy. No oracle manipulation. No integer overflow. The code did precisely what it was instructed to do. The Safe multisig instructed it to. And the detail that matters most is this: the team executed zero Safe transactions on the vault contract for 25 consecutive days before the drain. Twenty-five days of silence. In my line of work, silence is not peace. Silence is a signature. When a governance wallet goes quiet for that long and then suddenly moves, the move is rarely innocent.
To understand what broke, you have to see the vault as it actually sits inside DeFi's lego stack. It is a middle layer, and middle layers are where trust quietly concentrates. Upstream, it depends on Lido for wstETH, on Aave V3 to generate yield, and on Safe for governance. Downstream, it holds depositor capital. Its business is simple: take wrapped staked ETH, route it into Aave, let the aToken accrue, and pass the interest back to depositors. aBaswstETH is that receipt β Aave's interest-bearing claim on Base, appreciating as yield compounds. Nothing exotic. Nothing novel. A structure thousands of vaults share, and one that depositors rarely inspect past the headline APY.
The attack did not touch that structure. It touched the permission layer sitting on top of it. According to the disclosure, the attacker gained control of the Safe multisig and used it to add a malicious contract to the vault's lending whitelist. The whitelist is a safety mechanism β a curated list of contracts the vault is permitted to interact with. Once the multisig signed, the vault obediently withdrew 1,783 aBaswstETH and routed it through the malicious entry. The funds then flowed to Aave V3, where 1,783 wstETH was redeemed. Liquidity was deep, the redemption was clean, and the cash-out was near-instant. There was no struggle. There was no anomaly at the transaction level. Every call was authorized.
Zoom out and the vault's position is clear. It sits at the intersection of three dependencies β Lido, Aave, Safe β and depends on all three while none of them depend on it. That asymmetry matters. When the vault was breached, the upstream protocols shrugged. Aave kept its collateral logic intact. Lido's wstETH never wavered. Base's sequencer never blinked. The vault absorbed the entire loss because it was the only node in the chain whose security rested on a single multisig. In ecological terms, it was long-tail: small, substitutable, and cheap to abandon. Two facts bound the damage. Aave's core contracts and the Base chain itself were untouched β the blast radius stopped at the vault's door. And roughly $31.7M in remaining assets sits, still, in harm's way.
Here is the reconstruction, and it reads like a case file. The Safe multisig adds a malicious contract to the lending whitelist. The vault lending whitelist withdraws 1,783 aBaswstETH. Aave V3 redeems 1,783 wstETH. The attacker cashes roughly $6M. Three conclusions follow, and each indicts a different assumption.
First, this was not a contract being hacked. It was a key being stolen. The attacker never exploited a line of Solidity. They obtained signature authority over the Safe multisig and then called a function the contract was designed to honor. That is the entire point. A code audit would have found nothing, because nothing in the code was wrong. The defense perimeter was never in the contract. It was in the people and the process holding the keys. I built my first 40-point due diligence checklist in 2017 for exactly this reason β to separate the integrity of a structure from the integrity of the humans standing behind it. Years on, the lesson has not aged.
Second, the 25-day silence is a strong anomaly signal. In the 25 days before the attack, the team ran no Safe transactions on the vault. For an active yield vault, that is abnormal. It aligns uncomfortably well with a scenario in which the multisig was already controlled and the attacker was staging the exit. I flag this at medium confidence β silence alone is not proof, and quiet teams are not criminals. But combined with the timing, it points toward a premeditated breach rather than an opportunistic one. When I ran my 2020 slippage efficiency work on Uniswap, the same principle held: the useful signal is rarely the event itself. It is the deviation from baseline.
Third, the whitelist was reverse-engineered into a passport. The lending whitelist exists to constrain risk β to stop the vault from calling arbitrary contracts. Once the multisig fell, that same constraint became the attacker's legitimate access. A safety mechanism, turned against its owner, is the cleanest kind of exploit, because it leaves no fingerprint. This is the mirror image of codifying the intangible β turning a subjective trust into a concrete, transferable right. The vault codified trust in its multisig, and the attacker simply collected on it.
There is also a numbers problem worth auditing. A $6M loss against 1,783 wstETH implies a wstETH price near $3,365. If the event occurred while ETH traded near $2,400, the $6M figure either includes assets beyond wstETH or reflects a different valuation convention. I would verify the loss figure against the token count before repeating it. The ledger remembers what the narrative forgets β and the arithmetic here does not yet reconcile.
On the asset side, the composition is revealing. Holding aBaswstETH means the vault's underlying was wstETH, wrapped through Aave for yield. That places it squarely in the LST re-staking and yield-vault lane β a category where returns look attractive and governance is often an afterthought. The disclosure named no token, no emissions schedule, no treasury structure. So the token economics are a blank. But I have watched enough of these vaults to know the pattern: when a yield product cannot explain where its return comes from, the return usually comes from the depositor's own principal. Whether that applies here is unknown. That it should be asked is certain.
Transmission, then, is short and narrow. The attacker chose wstETH for a reason β deep liquidity, mainstream acceptance, easy to redeem inside Aave without touching a fragile DEX. That is the signature of deliberate target selection: high value, low friction, instant convertibility. It is also why the damage stayed local. There was no cross-protocol liquidation cascade, no contagion into Aave's markets, no systemic break. The fire burned one room and the walls held. For the yield-vault category, though, the smoke lingers. Expect tighter diligence and quieter capital in the coming quarter.
The reflex is to call for another audit. That reflex is wrong, and it is dangerous. Every mitigant that would have stopped this attack lives in governance, not in code. A timelock on the whitelist-add function would have inserted a delay between the malicious signature and the withdrawal β a window for the team or the community to detect and cancel. Permission separation would have kept whitelist authority out of a single multisig's reach. A monitoring alert on 25 days of multisig inactivity would have raised a flag long before the drain. None of these are code fixes. All of them are process fixes, and process is precisely where the industry under-invests.
This is where the instinct misleads. We have spent a decade selling audits as the safety net, and audits are genuinely valuable β for code. But the largest losses increasingly come from a layer audits do not cover. GoPlus named the possibilities plainly: social engineering or internal collusion. The first is an external attack meeting weak internal hygiene. The second is an insider turning on their own depositors. Those are not the same crime, and they carry completely different legal and recovery profiles. Treating both as a hack flattens the distinction that matters most β and it is the distinction that decides whether funds come back.
There is a legal edge here too. If this was an external compromise, it is a security incident. If it was internal collusion, it is fraud β and fraud carries criminal exposure, not just reputational cost. The vault's legal structure, which the disclosure never names, decides whether depositors have any claim at all. Many of these vehicles operate with the legal standing of a rumor. When they break, the members and the depositors discover that fact the hard way.
The most uncomfortable number is not the $6M already gone. It is the $31.7M still exposed. If the multisig has not been rotated, if the malicious whitelist entry has not been revoked, if the vault has not been paused, then the attacker may still hold the ability to extract again. The realized loss may only be the first installment. That is the risk the headline buries. In May 2022, when Terra collapsed, the difference between clients who acted on a rule and clients who waited for clarity was measured in millions. The rule here is the same: when control is compromised, exposure is the only variable you can still manage.
So watch the next on-chain movement, not the next press release. Whether the multisig is rotated, whether the whitelist entry is revoked, whether the $31.7M balance stays untouched β those are the signals that decide whether this is a $6M incident or a $38M one. And for anyone still chasing yield: when you deposit into a vault, you are not just trusting its code. You are trusting every human who holds a key to it. We do not build in the dark; we audit the light. The question is whether the light reaches the multisig β before the next 25 days of silence.
