Base

Gnosis

would

Ethereum

Safe

<p><strong>More than $6 million was reportedly stolen from an anonymous multisignature vault operating on Base, Coinbase's Ethereum layer-2 network, according to unconfirmed reports circulating as of October 4, 2026. No transaction hash, attacker identity, or on-chain evidence has been independently verified at the time of publication, and the claim has not been attributed to a named security firm, protocol team, or blockchain forensics provider.</strong></p>
<h2 id="what-the-reports-describe-and-what-they-do-not">What the Reports Describe, and What They Do Not</h2>
<p>The reported incident involves a multisignature vault holding in excess of $6 million, described as anonymous in that no publicly identified team, protocol, or individual has been linked to the address. The vault is said to have been deployed on Base, the Ethereum-compatible rollup developed by Coinbase, which has attracted significant DeFi activity since its August 2023 launch, as tracked by <a href="https://defillama.com/chain/Base" rel="noopener noreferrer nofollow">DeFiLlama's Base chain dashboard</a>. For related coverage, see <a href="https://www.coincu.com/revolut-users-personal-information-reportedly-leaked/" rel="noopener noreferrer nofollow">Revolut Data Leak: Personal Information Reportedly Exposed</a>.</p>
<p>Crucially, the available reporting does not specify the assets held, the exploit path used, how many signers controlled the vault, which signers may have been compromised, or whether any funds have been frozen or recovered. The loss figure of more than $6 million should be treated as approximate pending on-chain confirmation, as exact amounts frequently shift as blockchain investigators trace related addresses. This mirrors the uncertainty seen in the <a href="https://www.coincu.com/north-korean-hackers-drift-protocol-285m-offline-targeting/" rel="noopener noreferrer nofollow">Drift Protocol hack, where $285 million in reported losses required extensive forensic work</a> before figures stabilized. For related coverage, see <a href="https://www.coincu.com/solana-tokenized-stock-trading-volume-record-4-4-billion-september/" rel="noopener noreferrer nofollow">Solana Tokenized Stock Trading Hits Record $4.4B</a>.</p>
<h2 id="why-multisig-vaults-reduce-but-do-not-eliminate-theft-risk">Why Multisig Vaults Reduce, But Do Not Eliminate, Theft Risk</h2>
<p>Multisignature authorization requires multiple private keys to approve a transaction, distributing control so that no single compromised key can drain a wallet unilaterally. A 2-of-3 configuration, for example, demands that two of three designated signers approve any outgoing transfer before it executes on-chain.</p>
<p>Despite that design, multisig vaults remain vulnerable to social engineering, compromised signer devices, malicious contract upgrades, and flawed front-end interfaces that present fraudulent signing prompts. A theft of this reported scale would suggest that either multiple signers were simultaneously compromised, the vault's contract logic contained an exploitable flaw, or signers were deceived into authorizing a malicious transaction, though none of these vectors has been confirmed in the available reporting.</p>
<p>Similar incidents have demonstrated that multisig protections are only as strong as the operational security of each individual signer. When <a href="https://www.coincu.com/humanity-protocol-attackers-convert-stolen-funds-usdc-deposit-kucoin/" rel="noopener noreferrer nofollow">Humanity Protocol attackers converted stolen funds to USDC and deposited to KuCoin</a>, the breach also bypassed controls designed to distribute risk across multiple parties.</p>
<h2 id="what-remains-unverified-and-what-to-watch">What Remains Unverified and What to Watch</h2>
<p>Several core facts remain open as of publication. No block explorer entry on <a href="https://basescan.org" rel="noopener noreferrer nofollow">Basescan</a> has been publicly identified that corresponds to the reported drain, meaning the $6 million figure cannot yet be verified against an on-chain timestamp, sender address, or token breakdown. Without a transaction hash or vault address, independent researchers cannot confirm the amount, the authorization method used, or whether any funds remain in related wallets.</p>
<p>The identity of the vault's owners also remains unknown. An anonymous vault by definition has no publicly associated team, making notification, recovery coordination, and attribution significantly harder than in incidents involving named protocols. Readers should note that unnamed reports in the absence of a clearly attributed source, a named security firm, or an on-chain explorer link should be weighted accordingly.</p>
<p>Investigators and security researchers tracking the Base ecosystem will likely focus on whether any known multisig factory contracts, such as Safe (formerly Gnosis Safe), show anomalous activity around the reported date, and whether the drained assets have been routed through cross-chain bridges or decentralized exchanges. Prior incidents have shown that stolen funds move quickly; in the <a href="https://www.coincu.com/bitget-hackers-exchanged-351-6-million-stolen-eth-for-btc-thorchain/" rel="noopener noreferrer nofollow">Bitget hack, attackers swapped more than $351 million in stolen ETH for BTC via THORChain</a> within hours of the initial breach.</p>
<p>The next concrete milestones to watch are an on-chain address disclosure from a security firm such as Chainalysis, PeckShield, or Cyvers; a statement from any protocol or individual claiming the vault; and any exchange-level freeze requests that would indicate the stolen assets have been identified at a centralized venue. Until those data points surface, the reported $6 million figure and the theft claim itself remain unconfirmed. Coincu will update this article as verified on-chain evidence becomes available.</p>
<h2 id="faq-reported-6-million-base-multisignature-vault-theft">FAQ: Reported $6 Million Base Multisignature Vault Theft</h2>
<h3 id="what-was-reportedly-stolen">What was reportedly stolen?</h3>
<p>More than $6 million in unspecified assets held inside an anonymous multisignature vault on Base, according to unconfirmed reports. The exact token composition has not been disclosed.</p>
<h3 id="where-was-the-vault-located">Where was the vault located?</h3>
<p>On Base, the Ethereum layer-2 network operated by Coinbase.</p>
<h3 id="has-the-theft-been-independently-verified">Has the theft been independently verified?</h3>
<p>No. As of publication, no transaction hash, named security firm, protocol statement, or block explorer entry has been publicly linked to the reported incident.</p>
<h3 id="what-is-a-multisignature-vault">What is a multisignature vault?</h3>
<p>A smart contract wallet that requires approval from multiple private keys before any funds can move, intended to prevent single-point-of-failure theft.</p>
<h3 id="are-specific-users-or-protocols-confirmed-as-affected">Are specific users or protocols confirmed as affected?</h3>
<p>No. The vault is described as anonymous, and no protocol, team, or individual has been named in connection with the reported loss.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p>
<p>The post <a href="https://www.coincu.com/more-than-6-million-stolen-anonymous-multisignature-vault-base/" rel="noopener noreferrer nofollow">Over $6M Reportedly Stolen From Base Multisig Vault</a> was initially published on <a href="https://coincu.com/" rel="noopener noreferrer nofollow">Coincu</a>.</p>

Over $6M Reportedly Stolen From Base Multisig Vault

Table of Contents

Coincu

Other articles published on Oct 4, 2026

Join our free newsletter for daily crypto updates!