Base DEX RocketSwap Loses $869K After Server Bruteforced for Private Keys

Base, Coinbase's new layer-2 network, is attracting attention for reasons the exchange probably didn't intend. RocketSwap, a project deployed on the chain, says it lost approximately $869,000 after attackers bruteforced the server holding its private keys.

This is not the protocol's first brush with controversy; questions about the project had already been circulating on social media before the incident. It also follows a familiar pattern for Base: two weeks earlier, the BALD token rugpull was quickly followed by an exploit at LeetSwap. Critics see this as more evidence of low-effort projects chasing the fear-of-missing-out energy around any new chain, and argue that if Base is meant to signal a fresh wave of retail adoption, incidents like this undercut that narrative.

According to a timeline pieced together from posts by Certik, Peckshield, and RocketSwap itself, the project's farming contracts were drained through an internal address at roughly 11:00 PM UTC on August 14th.

Assuming the team's public account can be trusted, RocketSwap's own announcement described the mechanism as follows: the team had used offline signatures when deploying its launchpad and stored the associated private keys on a server. That server was then bruteforced. Because the farm contract relied on a proxy contract, the compromised keys carried several high-risk permissions, which the attacker used to move the farm's assets out. The team says it shut down the farm to limit further losses.

RocketSwap subsequently pledged to redeploy its farming contracts without a proxy layer and to give up minting privileges going forward. Observers noted, however, that the team disabled comments on its tweets and paused its community Telegram, which raised questions about how tightly it was managing the public narrative around the incident.

The attacker's address has been identified as 0x96c0876F573e27636612CF306C9db072d2B13DE8. On-chain activity shows the attacker bridging 472 ETH back to Ethereum mainnet and also launching a memecoin of their own, seeded with 400 ETH in liquidity — a move that echoes the BALD episode and suggests they may have been hoping to replicate its speculative frenzy.

Base has been framed by Coinbase as a demonstration of continued commitment to crypto's foundational ideas, arriving at a time when the exchange faces significant regulatory pressure from the SEC. Supporters point to Base's foundation on the OP stack and its stated focus on public goods as evidence of good intentions. Still, this messy launch period could hand additional ammunition to regulators like Gensler, and even well-meaning ecosystem participants have occasionally shown poor judgment about optics during this stretch.

So far, Base's early trajectory draws comparisons to the early days of BSC — another exchange-backed chain that became a haven for memecoins and rapid rug pulls. A separate project on Base, SwirlLend, has also since been rugged. Whether this is simply a predictable phase every new chain must pass through remains an open question.

RocketSwap's own statement to affected users read simply: "We are very sorry for your loss."