Base hacks in 2026

An accounting flaw in UNCX Network's shared Vesting V2 contracts let an attacker and copycats drain roughly $1.49 million in locked tokens across four chains.

An attacker minted 19 million unbacked THEO on Base through Autheo's Hyperlane cross-chain route and swapped them for about 700 ETH, crashing the token roughly 92%.

An attacker whitelisted a fresh contract on an unidentified Base vault and borrowed against its Aave V3 position to drain about 1,783 wstETH, roughly $6 million.

A shared-unlock accounting flaw in GoldPesa's Uniswap v4 hook let an attacker net a phantom USDC debt against the protocol's rebalancing withdrawal and drain about $114,900 on Base.

Attackers abused a flaw in Limit Break's Payment Processor NFT contract — still holding stale approvals from Magic Eden users — to drain tokens and NFTs worth at least $2.8 million across five chains.

An attacker inflated the price of the illiquid MAMO token to borrow real assets from Moonwell's lending markets on Base, draining about $8.7 million.

An attacker fed Allbridge's Base router a forged Circle CCTP message and padded it with an Aave flash loan to drain about $190,000 in USDC that a real deposit had just credited.

An attacker drained $820,000 in USDC from privacy protocol Hinkal — nearly its entire cross-chain TVL — via unverified 'proofless' deposits, then laundered it through Tornado Cash and THORChain.

A flash-loan-funded attacker inflated Edel Finance's internal wGOOGLx exchange rate ~78x, borrowing against phantom tokenized-Google-stock collateral to leave about $403,000 in bad debt.

A confused-deputy access-control flaw in New Market Trading's third-party SquidRouterModule let an attacker drain roughly $3.8 million from 88 Gnosis Safe wallets across Ethereum, Base, and Arbitrum.

~$10.8M drained from THORChain Asgard vaults across nine chains via a suspected GG20 threshold-signature flaw exploited by a malicious node operator.

Wasabi Protocol's perp vaults across Ethereum, Base, Berachain and Blast lost $5M when a compromised deployer EOA with sole ADMIN_ROLE allowed UUPS upgrades.

1B bridged DOT minted on Hyperbridge after a missing bounds check in VerifyProof let an attacker forge MMR proofs; realised loss ~$2.5M.

~$1.78M drained from Moonwell on Base after a newly listed market used a price feed with a decimals mismatch, mis-valuing collateral so attackers borrowed out.