Wasabi Protocol Loses $4.5 Million in Apparent Admin Key Breach

The DeFi sector continues to hemorrhage funds, with Wasabi Protocol being the latest victim, losing approximately $4.55 million on Thursday after its deployer key was compromised, according to security firm Blockaid. This incident is the latest in a string of DeFi losses that have exceeded $605 million across at least 12 incidents this month alone. The attack bears a striking resemblance to the Drift Protocol exploit, where North Korea-linked attackers utilized a compromised admin key to drain $285 million from the Solana-based perpetuals exchange. The breach was executed through an externally owned account called wasabideployer.eth, which held the sole admin role in Wasabi's permission system. Once the attackers gained access to the deployer key, they granted themselves admin privileges without delay by calling grantRole on the permission contract. Subsequently, their helper contract upgraded Wasabi's perp vaults and Long Pool to malicious implementations, effectively draining the balances. The exploit leveraged the Universal Upgradeable Proxy Standard (UUPS), which allows a smart contract to change its underlying code while retaining the same address. Although UUPS is widely used for its convenience in fixing bugs without necessitating user migration, its downside is the potential for an attacker, with admin permissions, to replace contract logic with malicious code designed to steal funds. Critically, Wasabi lacked both a timelock and multisig to protect the admin role. A timelock would have enforced a delay between the announcement and execution of admin actions, providing users with a window to react, while a multisig would have required multiple signers to approve changes. The absence of these safeguards meant that a single key held full control over the protocol. Blockaid identified the ongoing admin-key compromise exploit across Ethereum and Base, involving the Wasabi Deployer EOA granting ADMIN_ROLE to an attacker helper contract, which then UUPS-upgraded the perp vaults and LongPool to drain funds. Affected contracts include various vaults on both Ethereum and Base. Users with Wasabi LP tokens were advised to revoke any active approvals to the vault contracts due to the risk of drained or at-risk assets. This incident contributes to a month marked by significant DeFi losses, including the Drift Protocol breach and the $292 million loss by Kelp DAO. The cumulative DeFi loss for 2026 now surpasses $770 million across over 30 incidents, with April accounting for the majority of this figure. Smaller breaches have also been reported this month, affecting CoW Swap, Grinex, Resolv Labs, and Volo Protocol, among others. These incidents are linked by their exploitation of known vulnerabilities, highlighting the need for immediate implementation of lessons learned to prevent future breaches. Wasabi Protocol has yet to issue a public statement regarding the incident.