A Safe integration on Base was drained in a single transaction after its full steakUSDC balance moved from Safe address 0xfb17daaceec5a0678c146fd2def8675e5fa5840b.
The drain occurred at Base block 46455523, with the movement flagged as a protocol exploit rather than a phishing incident. The affected wallet held Steakhouse USDC, a Base Morpho vault token also listed as steakUSDC.
The incident adds another Safe-related integration risk to a week already marked by wallet-module concerns. A separate SquidRouterModule exploit drained 86 Gnosis Safes across Ethereum and Base, with stolen assets routed into DAI through attacker-controlled Uniswap V3 pools.
The Base incident is narrower but still important. A single transaction was enough to move the full steakUSDC balance, which places the focus on integration logic, permissions and protocol-level controls rather than ordinary user approval phishing.
steakUSDC Exposure Puts Morpho Vault Tokens In Focus
steakUSDC is tied to a Morpho vault structure on Base, where users receive vault shares representing exposure to deposited USDC and the underlying lending strategy. In this case, the drained asset was the vault token itself rather than native USDC sitting directly in the Safe.
That distinction matters because vault tokens can move as transferable assets. If an integration has authority over the Safe or its vault-token balance, a successful exploit can drain the position in one action before any manual response is possible.
Safe accounts are widely used by protocols, DAOs and treasury managers because they allow multisig control and modular execution. The same flexibility can become a risk when external modules, automated flows or integrations receive powerful permissions around asset movement.
Recent DeFi incidents have kept those permission layers under scrutiny. A Blockaid-flagged StablR Euro exploit showed how quickly an onchain incident can hit token markets and stablecoin liquidity, while the Base Safe drain shows how protocol-level integration issues can hit treasury-style positions directly.
Protocol Teams Review Safe Permissions
The immediate checks for teams using Safe integrations on Base are the affected Safe address, module and integration permissions, recent transaction history, approved spenders and any vault-token balances that can be moved by automated contracts.
The technical breakdown identified the drain as a protocol exploit, not phishing. That makes the next details more important: the exploited call path, the contract or integration that had authority over the Safe, the destination wallet, any swap route after the drain and whether other Safes share the same setup.
The broader security picture remains active across DeFi. Recent tracking showed DeFi exploit losses reaching $816.9 million as total crypto hack losses climbed above $1.1 billion, keeping attention on wallet permissions, protocol integrations and post-exploit response times.
For the affected Base Safe, the verified onchain markers are the Safe address, block 46455523 and the one-transaction movement of the full steakUSDC balance. The next update should come from transaction-level attribution, affected integration details and any mitigation notice for users or teams running the same Safe setup.
