Crypto assets worth $6 million have disappeared from a vault on the Base network.

An unknown actor drained 1,783 wrapped wstETH tokens—worth approximately $6 million—from a vault on the Base network, according to analysts at Blockaid.

Security experts reported that the attacker first tested the vulnerability with a small transaction of 1 aBaswstETH (a token received when a user deposits wstETH into the Aave protocol on the Base network). The hacker then executed five large transactions.

The attack was made possible by an error in the access control system, Blockaid analysts explained. The attacker took out a loan against the vault's assets, received aTokens (Aave tokens representing funds deposited into the protocol), and then exchanged them for wstETH via a custom smart contract, sending the funds to their own wallet.

Blockaid estimates that the hacker withdrew only a portion of the available funds; approximately $31.7 million in various assets remains in the compromised contract. These assets could remain at risk until control of the wallet is restored or the vulnerable contract is isolated.

Security experts noted a change in access settings shortly before the attack. The attacker's contract was initially removed from the list of authorized addresses but was subsequently re-enabled via a multi-signature wallet. Blockaid suggests this may indicate a compromise of the keys belonging to one or more project participants responsible for authorizing transactions.

So far, no decentralized finance (DeFi) protocol has publicly claimed ownership of the compromised smart contract.

Previously, experts from the blockchain security firm PeckShield reported the withdrawal of approximately $4.3 million from addresses associated with the crypto casino Duelbits. The funds were moved across the Ethereum and BNB Chain networks.