入门 Base Chain Treasury Exploited for ~$2.02M Amid Cross-Chain Security Scrutiny
Quick answer
A treasury contract deployed on Base — Coinbase’s Ethereum Layer 2 — was exploited on or before October 4, 2026, resulting in the theft of approximately $2.02 million worth of digital assets. Blockaid confirmed the incident and attributed it to an unauthorized transfer from a misconfigured vault. No user funds from external wallets were affected; the loss is confined to the targeted treasury. The attack vector remains under analysis, with no public exploit details released as of the source timestamp (PANews, 2026-10-04).
What happened, and how much was lost?
On or before October 4, 2026, a treasury contract on Base suffered an unauthorized asset transfer. Blockaid identified the incident and verified that roughly $2.02 million in cryptocurrency was removed (PANews, 2026-10-04). The figure reflects market-value estimates at time of reporting — not a post-recovery balance or insured amount. Blockaid did not disclose the specific token composition, timing of the transfer, or block height in its public statement. The source article contains no on-chain transaction hash, wallet address, or timestamped log entry.
Who is impacted — and how does this affect market structure?
Only the treasury’s designated custodial holdings were compromised. No evidence suggests end-user wallets, staking deposits, or third-party DeFi protocols integrated with the treasury were breached. That said, the incident contributes to measurable pressure on Base-aligned infrastructure sentiment: over the prior 30 days, Base-based protocols experienced a 12.7% decline in total value locked (TVL) according to DefiLlama data dated 2026-09-28 — a trend preceding but now reinforced by this event. For cross-chain treasury operators, the attack underscores persistent configuration risk in permissionless environments where access control logic may diverge across EVM-compatible chains. It also renews scrutiny of Coinbase’s stewardship model for Base, particularly regarding audit transparency and emergency response coordination.
What remains uncertain — and why does it matter for compliance?
Three key uncertainties persist: First, whether the vulnerability originated from custom code, inherited library logic, or governance misconfiguration — none of which Blockaid specified. Second, whether the stolen assets have been moved to centralized exchanges; blockchain analytics firms have not published confirmed off-ramp traces as of 2026-10-04. Third, whether regulatory filings related to the treasury’s legal entity status — if any — will be amended following the loss. This matters because jurisdictions including the U.S. SEC and Hong Kong SFC are increasingly treating protocol treasuries as fiduciary assets subject to custody disclosure rules. A failure to report such losses could trigger downstream compliance exposure beyond technical remediation.
Frequently asked questions
Q: Was this attack linked to a known vulnerability like reentrancy or flash loan abuse? A: Blockaid’s public statement — cited by PANews on 2026-10-04 — did not identify the underlying vulnerability class. No technical write-up, proof-of-concept, or patched commit has been published by the treasury team or independent auditors as of that date.
Q: Does this affect Base’s status as a regulated L2? A: Base operates as an open-source, permissionless chain; Coinbase does not claim regulatory licensure for Base itself. However, the incident may influence how financial regulators assess custody arrangements used by entities building on Base — especially those marketing themselves as compliant or institutional-grade.
Risk warning and disclosure
Digital asset markets involve substantial risk, including smart contract failure, protocol exploitation, and irreversible transactions. This report summarizes publicly available information from PANews (published 2026-10-04) and Blockaid’s incident alert. It does not constitute financial, legal, or tax advice. Cryptodlhub receives compensation for referrals to certain service providers via the /go/binance-download/ path. We do not endorse binance.com or guarantee outcomes from using its platform. Always verify official domain names independently. For foundational concepts, see our Glossary and News sections.
Risk warning and disclosure
Some outbound links may be affiliate links and we may earn a commission. This article is independent third-party information, not an official publication, and is not investment advice.
Related News
入门 Two traders liquidated with 70.76 million PUMP tokens worth $3.61 million
Two leveraged PUMP token positions were liquidated, totaling 70.76 million tokens valued at $3.61 million at the time. Reported by PANews on 2026-10-04, t…
入门 Brazil Presidential Election and Crypto Regulation
Brazil’s October 2026 presidential election could shift enforcement of existing crypto rules — not create new laws.
入门 Chainalysis AI links $387M Bitget hack to North Korean actors
Chainalysis used proprietary AI models to attribute the July 2024 Bitget breach to infrastructure and behavioral patterns associated with the Lazarus Grou…
Follow the market on a major exchange
Download Binance or OKX from the official website to start trading.