Wasabi Protocol Suffers $4.5 Million Loss Due to Apparent Admin Key Breach

The decentralized finance sector continues to experience significant losses, with Wasabi Protocol being the latest victim. On Thursday, the protocol, which operates as a perpetuals trading platform on Ethereum and Base, was drained of approximately $4.55 million after its deployer key was compromised, according to a report by security firm Blockaid. This incident is the latest in a series of DeFi losses, which have surpassed $605 million across at least 12 incidents this month. The attack on Wasabi Protocol shares similarities with the Drift Protocol exploit, where North Korea-linked attackers utilized a compromised admin key to drain $285 million from the Solana-based perpetuals exchange on April 1. The exploit was made possible through an externally owned account called wasabideployer.eth, which held the sole ADMIN_ROLE in Wasabi's permission system. Once the attacker gained access to the deployer key, they granted themselves admin privileges without delay by calling grantRole on the permission contract. The attacker then upgraded Wasabi's perp vaults and Long Pool to malicious implementations, resulting in the draining of balances, as reported by Blockaid. The exploit relied on the Universal Upgradeable Proxy Standard (UUPS), which allows a smart contract to modify its underlying code while retaining the same address. While UUPS is widely used for its convenience in fixing bugs without requiring user migration, it also poses a significant risk if an attacker gains control of admin permissions, as they can replace the contract's logic with malicious code designed to steal funds. A significant vulnerability in Wasabi's setup was the lack of a timelock or multisig protecting the admin role, as highlighted by Blockaid. The absence of these security measures meant that a single key held full control over the protocol, leaving it exposed to potential exploits. Following the incident, users holding Wasabi LP tokens were advised to revoke any active approvals to the vault contracts, as the underlying assets backing those tokens were either drained or remained at risk. The recent string of exploits, including the Drift and Kelp DAO incidents, underscores the need for enhanced security measures in DeFi protocols. The cumulative DeFi loss total for 2026 has now exceeded $770 million across more than 30 reported incidents, with the majority of these losses occurring in April. While smaller breaches have also been reported this month, the common thread among these incidents is the exploitation of known vulnerabilities, highlighting the importance of implementing lessons learned from previous exploits to prevent future occurrences.