The retired v1 vault lost its last 0.006142 WETH on 22 October 2026.
One transaction took the whole remaining balance of KerneVault v1, a retired WETH vault. The amount was 0.006142 WETH, about 12 US dollars that day. No kUSD reserve, no PSM contract and no skUSD balance was involved. The path was a known issue on that vault. This note gives the date, the amount, the path, and who reported it.
What happened
Read from Base on 13 Nov 2026 on two public RPC endpoints. Every row can be checked on Basescan.
| Fact | Value |
|---|---|
| Date and time | 22 Oct 2026, 09:03:01 UTC |
| Base block | 52,935,217 |
| Transaction | 0xf8c87b1986c6bb080283ccd344d2824219ba4a0ceaf204ac6a988d57abee0492 |
| Contract | KerneVault v1, retired, 0x8005bc7A86AD904C20fd62788ABED7546c1cF2AC |
| Paid out by the vault | 0.006285462916776036 WETH |
| Deposited by the same caller in the same transaction | 0.000143280712319556 WETH |
| Net amount taken | 0.006142182204456480 WETH |
| Taken by | 0x474d00B777eCDCc4F50EFa14d4dD243BC642FD4f, an address with no known link to Kerne |
| Vault balance now | 0 WETH and 0 ETH |
The vault still reports a totalAssets figure above zero. That figure is bookkeeping carried inside the contract. The token balances are what the vault holds, and they are zero.
The path
KerneVault v1 has a function, transferToPrime, that moves the vault's assets to a prime account. Its access check passes for the strategist, and also for the prime account the call names. A caller could name itself as that account, pass the check, and receive the vault's WETH. The transaction did that once, for the whole balance.
The function belongs to the vault contract. The kUSD token, the three PSM contracts that hold the USDC reserves, and skUSD do not have it, which was checked against their deployed bytecode on 13 Nov 2026. KerneVault v2 carries a function of the same name. v2 holds nothing, and no deposit opens into it until a remediated build is live.
Reports
- This path was first reported to Kerne on 25 May 2026. Five more researchers reported it by 16 June 2026. It was recorded as a known issue on a retired vault that held a small residual balance.
- Ucel X reported the path independently on 30 September 2026 and recommended emptying the vault. That recommendation was correct. On the same day the deposit cap on the vault was set to 1 wei, so new deposits revert. The residual balance stayed in the vault, and this transaction took it three weeks later.
- Ucel X is credited on the acknowledgments page. The earlier reporters are not named here because they have not asked for public credit for this finding.
What it did not touch
- kUSD reserves. The USDC that backs kUSD sits in three PSM contracts. Their balances did not change on 22 October, and the current figures are on the status page.
- skUSD. The staking vault is a separate contract and was not involved.
- KerneVault v2. It holds nothing, has never issued a share, and is closed to deposits.
v1 was already excluded from the reserve figures and from reported TVL before this happened, so no published backing number changed.
Who carries the loss, and why this is dated 13 November
The 0.006142 WETH belonged to holders of v1 vault shares. If you hold v1 shares, write to kerne.systems@protonmail.com.
Kerne's server and websites were offline from 14 October to 12 November 2026, which the status page covers. The transaction was found on 12 November during a review of the security inbox, the site came back that day, and this note was published the next day.