 Base blockchain exploit leads to $1M theft — Cyvers Alerts 
2024-10-25

An exploit involving unverified lending contracts on the Base blockchain has resulted in the theft of approximately $1 million.
The incident, which took place over several hours, was reported by blockchain security firm Cyvers Alerts in an X post on Oct. 25.
The attacker exploited a vulnerability in the smart contracts related to Wrapped Ether (WETH), successfully manipulated the price and then siphoned the funds.
Price manipulation exploit
The attacker’s initial suspicious transaction extracted $993,534 from the Base blockchain’s unverified lending contracts.
They moved most of the stolen funds to the Ethereum network and then deposited approximately $202,549 into the privacy-focused Tornado Cash service. Additional funds totaling $455,127 were taken using the same exploit.
In a written Q&A with Cointelegraph, Hakan Unal, senior SOC lead at Cyvers Alerts, explained the vulnerability exploited in the attack:
Security implications and prevention
The exploitation of unverified lending contracts in the event reveals the broader risks associated with decentralized finance (DeFi) platforms that fail to implement strong security measures. 
Unal explained that “a more reliable, diversified oracle with higher liquidity to avoid price manipulation” could be used to prevent similar attacks in the future, particularly “for assets like WETH.”
Who’s to blame?
Unal informed Cointelegraph that “the attacker managed to escape” with the funds stolen through exploiting “the price manipulation vulnerability.”
The attacker is yet to be identified and has successfully absconded with the stolen funds. 
This incident highlights a need for DeFi platforms to improve security protocols to protect user funds and ensure contract verification in the future to prevent similar events from occurring.