The Keys Were Stolen, Not the Code: Anatomy of a Base Vault Multisig Breach

Hook

For twenty-five days, nothing moved.

Not a single transaction. Not one whitelist update, not one parameter tweak, not one routine sweep of idle capital. On a Base-chain vault that had been designed to hum quietly in the background, twenty-five days of total silence was the loudest signal in the entire dataset — and almost nobody was listening.

I have a habit that has survived every market cycle I've lived through. Before I read a single line of Solidity in any yield vault, I ask to see the multisig. Not the audit. Not the GitHub. The signers. Who holds the keys, how many signatures are required, and what happens when one of those signers gets tired, distracted, or socially engineered over a cup of coffee. On that Tuesday, the habit paid off again — because the thing that broke on Base wasn't the code at all.

The vault didn't get hacked. The keys got stolen. And the difference between those two sentences is the difference between a bug and a betrayal — between a system that failed and a system that was walked out the front door by someone holding a valid signature.

GoPlus flagged it. A vault on Base. A Safe multisig that quietly added a malicious contract to its own lending whitelist. 1,783 aBaswstETH drained, redeemed through Aave V3 into 1,783 wstETH, cashed out for roughly six million dollars. And here's the part that should keep every depositor awake tonight: thirty-one point seven million dollars is still sitting there, still exposed, still waiting.

Let me walk you through it. Not as a news alert. As an anatomy lesson.

Context

To understand why this event matters, you have to understand what a vault actually is — and what it isn't.

A vault is a smart contract that holds other people's money and does something with it. That's it. That's the whole job. In the DeFi stack, a vault sits in the middle layer: users deposit assets on one side, and the vault deploys those assets into a strategy on the other. Sometimes the strategy is lending. Sometimes it's staking. Sometimes it's a tangled web of both, wrapped in an interest-bearing token that quietly grows in value while everyone sleeps.

The vault at the center of this story was a yield vault built on Base. Its underlying asset was wstETH — Wrapped Staked ETH, the Lido-issued token that represents ETH that has already been staked and is already earning. But the vault didn't hold raw wstETH. It held aBaswstETH, the Aave-issued receipt token that represents wstETH deposited into Aave V3. That receipt grows in value as interest accrues. Deposit, wait, withdraw a little more than you put in. Simple. Elegant. And completely dependent on the governance layer that sits above it.

That governance layer was a Safe multisig.

If you've spent any time in crypto, you know Safe. It's the standard smart-contract wallet used by DAOs, foundations, and treasuries across the ecosystem. Instead of a single private key controlling an address, a Safe requires multiple signers to approve a transaction before it executes. A three-of-five, a four-of-seven — the configuration varies, but the principle is the same. No single person can move the money alone.

On paper, that's decentralization. In practice, it's a committee. And committees have members, and members have laptops, and laptops have phishing emails.

The vault's multisig held a specific and dangerous power: the ability to add contracts to the lending whitelist. A whitelist, in this context, is a security feature. It's a list of approved contracts that the vault is allowed to interact with. If a contract isn't on the list, the vault can't touch it. The logic is sound — it prevents the vault from being tricked into interacting with a malicious contract that was never approved.

But here's the inversion that nobody plans for. When the multisig itself is compromised, the whitelist stops being a shield and becomes a passport. The attacker doesn't need to break the gate. They just sign their way through it.

That's what happened here. Someone — or some group — got control of enough Safe signatures to add a malicious contract to the whitelist. Once that contract was approved, the vault treated it as a trusted counterparty. The vault did exactly what it was designed to do. It followed the rules. And the rules had been rewritten by the wrong hands.

This is the part I keep coming back to. The vault was not negligent in the way people assume negligence looks. Its code may have been flawless. Its audit may have been clean. Every line of logic may have behaved precisely as specified. The failure lived one layer up, in the human and operational layer that most security reviews treat as an afterthought.

Core

Let me reconstruct the attack chain, because the elegance of it is what makes it so dangerous.

Step one: the multisig. At some point — and the twenty-five-day silence suggests it happened well before the attack itself — the attacker gained the ability to produce valid Safe signatures. Whether that came from a phishing page that mimicked the Safe interface, a compromised signer's device, a fake firmware update prompt, or an insider who simply decided to help themselves, the result is identical. The attacker now had a legitimate voice in the governance process.

Step two: the whitelist. With signature power in hand, the attacker added a malicious contract to the vault's lending whitelist. From the vault's perspective, nothing unusual happened. A governance action was proposed and approved. The whitelist updated. The system hummed along.

Step three: the withdrawal. The vault, now authorized to interact with the attacker's contract, moved 1,783 aBaswstETH into it. This is the moment the money left the building — not through a broken window, but through the front door, with the key, during business hours.

Step four: the redemption. The attacker took that aBaswstETH to Aave V3 and redeemed it for 1,783 wstETH. This is the step that reveals how carefully the target was chosen. Aave V3 is one of the deepest liquidity venues in all of DeFi. Redeeming aBaswstETH there is instant, reliable, and requires no fragile external market. The attacker didn't have to hunt for a buyer. Aave was the buyer.

Step five: the exit. The wstETH was converted into roughly six million dollars. Depending on where that conversion happened, the trail may run through a centralized exchange or through a mixing service. Either way, the money is gone, and the odds of recovery are somewhere between slim and imaginary.

Now let me tell you what this chain actually teaches, because the sequence matters more than the sum.

First: this is a governance attack, not a code exploit. There was no reentrancy. There was no oracle manipulation. There was no integer overflow, no flash loan, no price feed spoofing. The attacker never needed to find a bug because they never needed the code to misbehave. They needed the code to behave exactly as written — and it did. This is the crucial reframe. We've spent a decade teaching developers to write safer code, and the industry has gotten genuinely good at it. Audits are sharper. Fuzzing is standard. Formal verification is no longer exotic. And yet the money keeps leaving, because the money doesn't leave through the code anymore. It leaves through the keys.

Second: the whitelist was weaponized against its own purpose. I want to sit with this for a moment, because it's the most instructive detail in the entire event. A whitelist exists to restrict what a contract can touch. It's a conservative, defensive design choice — the kind of thing a cautious team adds precisely because they're worried about unknown counterparties. And that caution became the attack vector. The mechanism designed to keep bad actors out became the mechanism that let one in. This is what I mean when I say security mechanisms can be defeated by dimensionality reduction. The defender built a wall. The attacker didn't climb it — they walked through the gatehouse and told the guard the wall was now a road.

Third: the asset choice was not accidental. aBaswstETH and wstETH are among the most liquid, most trusted, most composable assets in the entire ecosystem. That's exactly why they were targeted. An attacker who steals a long-tail token has a problem: they own something nobody wants to buy. An attacker who steals wstETH has no such problem. They own something that redeems instantly, deepens into the largest lending market in DeFi, and converts to cash with minimal slippage. The victim vault was holding assets that were, from the attacker's perspective, already money. This is the plug-and-play nature of modern DeFi theft, and it's a direct consequence of the composability we celebrate. The same Lego bricks that let a vault earn yield let an attacker disassemble it in minutes.

Fourth: the twenty-five-day silence is the smoking gun. This is where my audit habit earns its keep. Before the attack, the team had not executed a single Safe transaction on the vault contract for twenty-five days. For an active vault, that's abnormal. It's the kind of pattern that should trigger an alert in any serious monitoring system. Silence in a governance log is not peace — it's often the sound of a door being left open. The timing aligns almost perfectly with the scenario where the multisig was already controlled and the attacker was quietly staging the operation. This was not an opportunistic smash-and-grab. It was a patient, premeditated theft. The attacker didn't rush. They waited, positioned, and struck when the moment was right.

Now let me put numbers on the part that should frighten you most.

The realized loss was roughly six million dollars, corresponding to 1,783 wstETH. If you do the division, that implies a wstETH price of about $3,365. I want to flag this because there's a tension worth examining. If the event occurred during a period when ETH was trading closer to $2,400, then a six-million-dollar loss against 1,783 wstETH doesn't reconcile cleanly. Either the loss figure includes assets beyond the wstETH, or there's a valuation discrepancy somewhere in the reporting, or the price assumption is off. I've learned to distrust round numbers in incident reports. They're usually approximations dressed up as precision. The honest answer is that we don't have enough disclosure to reconcile the arithmetic, and that itself is a red flag about how this incident is being communicated.

But the arithmetic that matters most is the residual one. Thirty-one point seven million dollars remains in the vault, still at risk. Read that again. The attack is not over. The realized loss of six million is the opening chapter, not the epilogue. If the multisig is still compromised — and nothing in the disclosure suggests it has been secured — then the attacker retains the ability to strike again. The total exposure could climb toward thirty-eight million dollars. Every hour that passes without the multisig being replaced, the malicious whitelist being revoked, and the vault being paused is an hour in which a second withdrawal could occur.

This is the single most urgent fact in the entire event, and it's buried under a headline number that makes it sound like the damage is done. The damage is not done. The damage is in progress.

Let me zoom out to the structural level, because individual incidents are only interesting insofar as they reveal systemic patterns.

The vault occupied a specific position in the DeFi dependency graph. Upstream, it depended on Lido for wstETH, on Aave for the yield-bearing aToken, and on Safe for governance. Downstream, it served depositors who trusted it to manage their capital. That makes it a middle-layer node — a connector. And connectors have a particular kind of vulnerability: they can fail without taking their dependencies down with them.

That's precisely what happened. Aave's core contracts were untouched. Base itself was untouched. Lido's wstETH was untouched. The upstream protocols did their jobs. The failure was contained to the connector, and the losses were pushed downstream to the users. This is the shape of most DeFi failures, and it's worth naming clearly: the protocols we consider "too big to fail" are often insulated precisely because they sit beneath the layer where the risk actually accumulates.

The dependency was also asymmetric. The vault needed Aave and Lido to function. Aave and Lido did not need the vault. In a dependency graph, the party with fewer alternatives has less leverage, and this vault had almost none. It was replaceable. It was, in all likelihood, a small-to-mid-sized project with no independent market voice — the kind of long-tail protocol that most people never hear about until it appears in a post-mortem. And that's the cruel irony of the long tail. Its failures are contained, but so is its ability to recover. When a giant stumbles, the ecosystem rallies. When a nobody stumbles, the ecosystem shrugs.

Now let me address the governance model directly, because this is where the preventable failure lives.

The vault granted the ability to add contracts to the lending whitelist to a Safe multisig — and, as far as the disclosure reveals, it did so without a Timelock. I cannot overstate how significant that omission is. A Timelock is a delay between the approval of a governance action and its execution. It's the single cheapest, most effective defense against exactly this attack. If a Timelock had been in place, the moment the attacker added the malicious contract to the whitelist, a countdown would have started. The team, the community, or any monitoring bot watching the contract would have had a window — hours, days — to notice the change and cancel it before any funds moved.

A Timelock turns a silent, instant compromise into a loud, slow, interceptable one. It converts the attacker's greatest advantage — speed and stealth — into a liability. And it costs almost nothing to implement. The absence of a Timelock on a high-privilege action is not a subtle design flaw. It's an unforced error, and it's the kind of error that keeps repeating across the ecosystem because teams optimize for convenience and speed over the boring, slow, unglamorous work of building delay into their own power.

Beyond the Timelock, there's the monitoring gap. Twenty-five days of no Safe transactions produced no alert. No bot flagged the silence. No human noticed the inactivity. This tells us the team had no anomaly detection on its own governance layer. They were watching the market. They were not watching the keys. And in a world where the keys are the attack surface, that's the equivalent of installing a security system on your windows while leaving the front door wide open.

Then there's the question that GoPlus raised and that no one can answer yet: social engineering or insider collusion? The disclosure explicitly notes both possibilities. These are not equivalent outcomes, and the distinction matters enormously. Social engineering is an external attack meeting internal weakness — a phishing page, a fake update, a signature tricked out of a tired signer. Insider collusion is internal betrayal — someone with legitimate access deciding to steal. The first is a defense failure. The second is a trust failure. And the response, the legal exposure, and the recovery prospects differ radically between them.

What I can say with reasonable confidence is that the twenty-five-day silence tilts the evidence toward long-term control rather than instantaneous compromise. An attacker who phishes a signature usually strikes fast, before the victim realizes what happened. An attacker who holds control for weeks is patient, deliberate, and confident in their access. That pattern looks less like a mugging and more like a tenant who quietly changed the locks months ago and has been living in the building ever since.

The broader ecosystem implications deserve their own paragraph, because they're easy to miss.

This event reinforces a lesson the industry keeps learning and keeps forgetting: in mature DeFi, code is no longer the primary attack surface. Governance is. The exploits that made headlines years ago — the reentrancy bugs, the oracle manipulations — have been largely engineered out of the top protocols through better tooling and harder-won experience. What remains is the human layer: the signers, the processes, the operational security, the monitoring, the delays. And that layer is far harder to audit, far harder to standardize, and far easier to compromise, because it doesn't fail in a compiler. It fails in a browser tab at eleven at night.

This should shift where we spend our defensive energy. Code audits remain necessary. They are no longer sufficient. The vault in this story may have passed every code review it ever received and still lost six million dollars, because the review never asked who could sign, how quickly, and what would happen if the answer was "the wrong person." Governance audits, operational security assessments, signer hygiene training, transaction simulation, and Timelock mandates — these are the defenses that would have mattered here, and they're the defenses that remain an afterthought in most protocols' security budgets.

There's also a narrative dimension worth naming. Every incident like this feeds a story, and the story shapes behavior. The story here is not "DeFi is broken." Aave held. Base held. Lido held. The story is narrower and more useful: "the middle layer is where the risk lives, and the middle layer is where the governance is weakest." That's a story that, if it spreads, could actually make the ecosystem safer — by pushing capital toward protocols that take governance seriously and starving the ones that don't.

I've watched enough of these cycles to know how the response usually goes. The disclosure drops. The Twitter threads fire up. A few people say "this is why we need better multisig hygiene." Then the news cycle moves on, the lesson fades, and three months later another vault gets drained the same way. I've been part of that forgetting. I've written the urgent thread and then moved on to the next shiny thing. That's a habit I'm trying to break, because the repetition isn't a coincidence. It's a structure. The structure keeps producing the same failure because nobody changes the structure.

What would change the structure? Timelocks as a default, not an option. Multisig monitoring as a baseline, not a luxury. Signer hardware and process hygiene treated as seriously as smart contract correctness. And a culture that rewards the boring work of building delay and detection into governance, instead of treating it as friction to be removed.

None of that is technically hard. All of it is culturally hard. Which is why it keeps not happening.

Contrarian Angle

Here's where I want to push against the comfortable reading of this event, because the comfortable reading is wrong in a way that matters.

The comfortable reading says: "A vault got hacked because it was poorly secured, and better code would have prevented it." This reading is comforting because it implies the problem is solvable with more engineering. Write better contracts, run more audits, and the attacks stop. It lets us keep believing that the smart contract is the unit of security.

But look at what actually happened. The code worked. The vault did exactly what it was programmed to do. It accepted a whitelisted contract, moved funds into it, and executed a redemption — all within the bounds of its design. There was no bug to fix. There was no patch that would have stopped this. The failure lived entirely in the space the code couldn't see: the humans holding the keys.

This means the entire framework of "code audit" — the ritual that anchors DeFi security — is structurally blind to the attack that just happened. You can audit a contract until your eyes bleed and never once ask the question that mattered: who can sign, and what stops them? The audit industry has built a cathedral of tooling around a threat model that has quietly shifted underneath it. We're guarding the vault door while the thief walks in through the boardroom.

And here's the deeper contrarian point. We talk about "trustless" systems as if the absence of trust is the goal. But this event proves the opposite. The vault was trustless in its code and completely trust-dependent in its governance. The code didn't need to trust anyone. The humans needed to trust each other absolutely — and that trust was either betrayed or exploited. The most "trustless" part of the system was the least relevant to its security, and the most trust-dependent part was the single point of failure.

I learned this the hard way years ago, and I keep relearning it. Trustless systems require trusting relationships. The code can be trustless. The people cannot. And when we pretend the code's trustlessness extends to the humans running it, we build a false sense of safety that's more dangerous than honest, acknowledged centralization would be. At least a centralized custodian knows they're a custodian. A multisig cosplaying as decentralization can forget it's a committee until the committee betrays it.

The other contrarian angle: the whitelist, that cautious safety feature, became the weapon. The team added it out of prudence. They were thinking about unknown contracts and external threats. They were not thinking about the possibility that the threat would come from inside the governance layer that controlled the whitelist. This is the blind spot that runs through the entire event — every defense assumed the attacker was outside the perimeter. Nobody built a defense against the attacker being the one who holds the perimeter.

And one more thing, because it needs saying. Thirty-one point seven million dollars remains exposed, and the response so far has been a disclosure, not a remediation. Where's the pause? Where's the multisig replacement? Where's the whitelist revocation? If the team still controls the multisig and hasn't acted, that's a second failure stacked on the first — not an attack, but a failure of incident response. The most damning thing about this event may not be that the keys were stolen. It may be how slowly anyone moved to change the locks after the theft was discovered.

Takeaway

So here's where I land, and it's not a comfortable place.

The next major DeFi loss won't come from a clever exploit. It won't come from a line of code nobody saw. It'll come from a signature nobody questioned, approved in a window nobody was watching, on a contract nobody paused. The attack surface moved years ago. Most of us just haven't moved with it.

Ask yourself the question I ask before every vault I touch: if the keys were stolen tomorrow, how long would it take anyone to notice? If the answer is "twenty-five days," then the vault isn't safe — it's just quiet.

And quiet, in this ecosystem, is never the same thing as safe.