Wasabi Protocol Loses $4.5 Million Due to Admin Key Breach

The decentralized finance sector continues to experience significant losses, with Wasabi Protocol being the latest victim, having been drained of approximately $4.55 million on Thursday following a deployer key compromise, as reported by security firm Blockaid. This incident is the latest in a string of over 12 DeFi-related breaches this month, resulting in cumulative losses exceeding $605 million. The attack on Wasabi Protocol closely mirrors the exploit on Drift Protocol, which occurred on April 1 and saw North Korea-linked attackers utilize a compromised admin key to drain $285 million from the Solana-based perpetuals exchange. The breach was facilitated through an externally owned account known as wasabideployer.eth, which held the sole ADMIN_ROLE within Wasabi's permission system. Once the attackers gained access to the deployer key, they granted themselves admin privileges without delay by invoking the grantRole function on the permission contract. A helper contract was then used to upgrade Wasabi's perp vaults and Long Pool to malicious implementations, resulting in the draining of balances, according to Blockaid. The exploit leveraged the Universal Upgradeable Proxy Standard (UUPS), which enables a smart contract to modify its underlying code while retaining the same address. Although UUPS is widely used due to its ability to allow developers to fix bugs without requiring user migration, it also poses a significant risk if an attacker gains control of admin permissions, as they can replace the contract's logic with malicious code designed to steal funds. Blockaid noted that Wasabi lacked a timelock or multisig to protect the admin role. The absence of these security measures meant that a single key held full control over the protocol, leaving it vulnerable to exploitation. Blockaid's exploit detection system identified an ongoing admin-key compromise exploit on Wasabi Protocol across both Ethereum and Base. The compromised contracts include Wasabi's wWETH, sUSDC, wBITCOIN, wPEPE, and Long Pool vaults on Ethereum, as well as its sUSDC, wWETH, sBTC, sVIRTUAL, sAERO, and sBRETT vaults on Base. Users holding Wasabi LP tokens were advised to revoke any active approvals to the vault contracts, as the underlying assets backing those tokens were either drained or remained at risk. This month has seen a string of exploits, including the Drift breach, which also involved a single-key admin setup with no governance timelock. On April 19, Kelp DAO lost $292 million when an attacker exploited a single-verifier configuration in the protocol's LayerZero bridge. The total DeFi loss for 2026 has now surpassed $770 million across over 30 reported incidents, with April accounting for the majority of this figure. Smaller breaches this month have also occurred, including those affecting CoW Swap, Grinex, Resolv Labs, and Volo Protocol. A common thread among these incidents is not a new vulnerability, but rather the repeated exploitation of existing weaknesses, with each post-mortem analysis highlighting lessons learned, only for the next exploit to occur before these lessons can be implemented. Wasabi Protocol has yet to issue a public statement regarding the incident.