October 10, 2026

3.4M from the hacked Base vault unlocks on October 11. Exchanges should be watching

On October 4, a vault on Base lost 1,783 wstETH (~$6M). We traced the money on-chain, and the story has a date for its next move.

HOW IT HAPPENED

At 08:53 UTC the vault's own 3-of-7 Safe multisig, with valid signatures, put a contract back on the whitelist. Minutes later that contract pulled 1,783 wstETH out through Aave. No bug in Aave: someone had signing power.

WHERE THE MONEY WENT

• 10:47 UTC: 1,782 wstETH moved to a fresh wallet 0xc734…7f8d.
• 12:10 UTC: 1,000 wstETH sent into the Base → Ethereum bridge.
• 782 wstETH (~$2.6M) still sits in that same wallet on Base. It hasn't made a single transaction since October 4. We checked today.

WHY OCTOBER 11 MATTERS

A Base → Ethereum withdrawal takes two steps: a proof first, then the funds 7 days later. The attacker submitted the withdrawal proof on Ethereum on October 4 at 13:44 UTC. So the 1,000 wstETH (~$3.4M) can be claimed from around October 11. Nothing has arrived at that address on Ethereum yet.

That's when the money starts moving again, toward swaps and exchanges.

WHAT IT MEANS FOR YOU

Both addresses are already flagged in our check:

• attacker 0x0B5126e1bc27C0de77e02e97945760A674EdB034
• cash-out 0xc73448432a05deea5ea18a07d3b5d9ccf6297f8d

If funds linked to them reach your wallet or your exchange desk, the check will show it.

🔎 Check a sender: https://amlconsensus.com/en