Base Vault Loses Over $6M in wstETH to Unknown Attacker

The detail that stands out is the 3-of-7 Safe with unidentified signers: the failure point sits in key management and authorization, not in Base or Aave, which limits the blast radius to this vault's own configuration. That distinction matters for anyone relying on multisig Safes as a security guarantee, since an unconfirmed authorization flaw implies the mechanism itself may be the weak link rather than the chain. Whether the specific flaw is ever identified, and whether similar Safe setups face comparable exposure, is the open question worth tracking.