# Base · Drain Watch

7 incidents, 2 live. JSON: https://drains.watch/t/base.json · RSS: https://drains.watch/t/base/feed.xml

- [Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances](https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026) (live, Critical, Contained, since Sep 24, 2026)
- [Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server](https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026) (live, Medium, Still active, since Sep 8, 2026)
- [Trader loses over $200K from two SIGMA Telegram bot wallets in apparent private-key leak](https://drains.watch/i/sigma-telegram-bot-wallets-key-leak-200k-may-2026) (closed, High, Contained, since May 11, 2026)
- [Encoded X post tricks Grok and Bankrbot into sending about 3 billion DRB tokens from Grok's wallet](https://drains.watch/i/grok-bankrbot-morse-code-prompt-injection-drb-may-2026) (closed, High, Partly contained, since May 4, 2026)
- [Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key](https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026) (closed, Critical, Still active, since Apr 30, 2026)
- [Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer](https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025) (closed, Critical, Contained, since Nov 21, 2025)
- [Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet](https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025) (closed, High, Contained, since Mar 18, 2025)