A vault on Base was drained of roughly $6 million in Aave deposit tokens, with the funds moving out through six separate outflows after a change to a borrower whitelist. The proceeds were swapped into wstETH, and some of that wrapped staked ether has since entered bridge withdrawals pointing toward Ethereum. The vault, the whitelist operator, and the entity that pulled the funds have not been named in what's been disclosed so far.
The whitelist change came first
Whitelists are supposed to be the boring part of a lending setup — a list of approved borrowers, updated when someone new gets access. Here, the update appears to have opened the door rather than closed it. Six outflows followed, which rules out a single fat-finger transaction or one compromised key firing off a lone transfer. Six separate moves takes coordination, or at least a script that knew where to go.
The amounts per outflow haven't been broken out. What matters is the direction: everything left in Aave deposit tokens, the receipt-style tokens you get for parking assets in Aave, not the underlying assets themselves. That's a deliberate choice. Deposit tokens are liquid, easy to move, and don't require unwinding a position inside Aave to get them out the door.
wstETH, then a bridge
Once out, the deposit tokens were redeemed for wstETH — wrapped staked ether, the yield-bearing version of ETH that trades on secondary markets. That's a two-step conversion: exit the lending receipt, land in a liquid staking wrapper. Anyone doing that isn't planning to sit still.
Some of the wstETH then entered bridge withdrawals toward Ethereum. Base is an Ethereum rollup, so moving value back to the main chain isn't exotic — it's routine for anyone who wants deeper liquidity or access to venues that don't exist on Base. But it does mean part of the trail now runs across two chains, which complicates any attempt to freeze or claw back funds on the Base side alone.
What's not clear yet
Nobody has said whether the whitelist change was made by an authorized party who then abused it, or by someone who shouldn't have had access at all. Those are very different incidents. The first is an inside job with a paper trail; the second is a security failure with a much messier story.
There's also no word on whether the vault's operator has contacted law enforcement, paused further deposits, or begun working with bridge operators on the Ethereum side. Bridge withdrawals aren't instant — they typically go through a challenge or finalization window — which leaves a narrow gap where funds could theoretically be intercepted if anyone's watching closely enough and has the standing to act.
The next thing to watch is whether those bridge withdrawals complete or get held up. If they land on Ethereum and move again, recovery gets harder with every hop. If they stall, there's still a window. As of now, the funds are in motion and the people behind the six outflows haven't been identified.
