News

369 Guard

Global security awareness — not only PulseChain.

Permalink for this incident. Same content as the News feed — use Share to post it.

All newsAbout

Cross-chain security awareness in plain English. Not an audit. Not financial advice. We never publish drain recipes or exploit steps. News items are research snapshots from public reporting — not always a full 369 deep-dive.

mediumBasedefi

Base WETH allowance / unrestricted call ~$31k

~1 Aug 2026: Onchain Lens (with SlowMist first-spot) reported 16.623 WETH (~$31k) drained on Base after an unverified helper spent a victim’s existing WETH allowance. Flow: victim → unverified spender → fresh helper → attacker wallet; funds still sitting with the attacker at report time. Victim publicly offered a white-hat split; no refund observed yet. Not a named blue-chip vault — residual approve on a contract with an open external-call surface. A near-identical attempt the next day only produced zero-value transfers. Confirmed firm alert + Basescan tx.

369 take: Old unlimited (or leftover) approvals on unverified routers and “call anything” helpers are still a live drain path — even at $30k on L2s. Pulse lesson: revoke stale allowances, never leave spend rights on sketchy helpers after you walk away from a UX, and treat unverified multicall-style contracts as hostile until proven otherwise.