Base
7 incidents, 2 live. 28 days since the last new one.
6 drains in the last 12 months
6 drains in the last 12 months
5 drains in 2026
2 drains in 2025
Live
-
Critical✓Contained
Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances
Attackers exploited a zero-day in two third-party security appliances at exchange Bitget, moved on to its production wallet job server and used a custom withdrawal tool to drain hot and warm wallets on 24-25 September 2026. The confirmed loss is about $387.5 million (first reported as $351.6M) across Ethereum, Arbitrum, Avalanche, Optimism, BSC, Base and the XRP Ledger. Bitget's CEO blamed North Korean hackers, and Bitget said cold wallets and private keys were not compromised. Hacken's Q3 figures say about $387M was covered by Bitget's user protection fund.
Bitget exchange hot and warm wallets·Ethereum, Arbitrum, Avalanche, Optimism, BNB Chain, Base·$388M stolen·Since Sep 24, 2026·
-
Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server
Knostic reported on 8 September 2026 that gadgethumans-mcp, an npm MCP server that promises AI agents automatic x402 micropayments, asks users to set a wallet private key but does no local signing. Instead it copies the raw key into a request header and sends it to a remote endpoint on every recognized tool call, which would let whoever receives it take over the wallet. The package had 2,327 downloads in July and August 2026 and was still on npm when the report came out; Knostic found no confirmed thefts. Anyone who set a key in it should move funds and use a fresh, low-balance wallet.
gadgethumans-mcp (npm)·Base·Since Sep 8, 2026·
Past
May 2026 2
-
High✓Contained
Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak
On 11 May 2026 a crypto trader lost over $200,000 across Ethereum, Base and BSC from two wallets created by the SIGMA Telegram trading bot; the largest losses were about $125,000 in POD on Base and $21,000 in FHE on BSC. An on-chain analyst said the drain used the private keys directly, with no token approval involved, while the victim's other wallets were untouched. The cause is unconfirmed; suggestions include fake CAPTCHA bots in Telegram, infostealer malware or a device compromise. Users of bot-generated wallets should keep balances small and never run 'verification' steps a Telegram bot asks for.
SIGMA Telegram trading bot wallets (one trader)·Ethereum, Base, BNB Chain·$200K stolen·Since May 11, 2026·
-
Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet
On 4 May 2026 an attacker drained about 3 billion DRB tokens, worth roughly $150,000 to $200,000 depending on the estimate, from a Bankr wallet linked to xAI's Grok on Base. Reports say the attacker first sent the wallet a free Bankr Club membership NFT that widened what it could authorize, then posted a Morse-coded message; Grok decoded it and the Bankr automation treated Grok's reply as a valid transfer order. No private key, smart contract or malware was involved, and some funds were later returned. An AI's text output should never count as permission to move money.
Grok-linked Bankr wallet (Bankrbot on X)·Base·$155K stolen·Since May 4, 2026·
April 2026 1
-
Critical✕Still active
Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key
On 30 April 2026 an attacker used the compromised key of wasabideployer.eth, an ordinary wallet that held Wasabi's only ADMIN_ROLE, to grant themselves admin rights with no delay. A helper contract then upgraded the perp vaults and Long Pool on Ethereum and Base to malicious code that emptied them. CoinDesk put losses at about $4.55M; Blockaid flagged the attack. Wasabi LP holders were urged to revoke approvals to the vault contracts.
Wasabi Protocol vaults and LP holders (Ethereum, Base)·Ethereum, Base·$4.5M stolen·Since Apr 30, 2026·
November 2025 1
-
Critical✓Contained
Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer
On 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise.
Aerodrome (Base) and Velodrome (Optimism) web app users·Base, Optimism·$700K stolen·Since Nov 21, 2025·
March 2025 1
-
Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet
On 18 March 2025 an attacker got into the dashboard of AIXBT, an autonomous AI crypto agent, and queued two prompts that made it transfer about 55.5 ETH (about $106,200) out of its wallet on Base. The maintainer said core systems were not affected and the AI itself was not manipulated; the weak point was access to the agent's control dashboard. Keys were swapped, dashboard access was paused and the attacker's addresses were reported to exchanges. Anyone running an AI agent with a wallet should lock down its control panel and cap what it can send.
AIXBT AI agent wallet·Base·$106K stolen·Since Mar 18, 2025·
No drains match these filters.