Wasabi Protocol Suffers $4.5 Million Loss Due to Apparent Admin Key Breach

The DeFi sector continues to experience significant losses, with Wasabi Protocol being the latest casualty. On Thursday, the platform, which facilitates perpetuals trading on Ethereum and Base, was drained of around $4.55 million after its deployer key was compromised, according to security firm Blockaid. This incident is part of a larger trend, with over $605 million lost in DeFi across at least 12 incidents this month alone. The attack on Wasabi closely resembles the Drift Protocol exploit, where North Korea-linked attackers used a compromised admin key to drain $285 million from the Solana-based perpetuals exchange on April 1. The breach was executed through an externally owned account called wasabideployer.eth, which held the sole admin role in Wasabi's permission system. Once the attackers gained access to the deployer key, they granted themselves admin privileges without delay by calling grantRole on the permission contract. Subsequently, a helper contract was used to upgrade Wasabi's perp vaults and Long Pool to malicious implementations, resulting in the draining of balances, as reported by Blockaid. The exploit leveraged the Universal Upgradeable Proxy Standard (UUPS), which allows a smart contract to modify its underlying code while retaining the same address. Although UUPS is widely used for its convenience in fixing bugs without migrating users, it poses a significant risk if an attacker gains control of admin permissions, as they can replace the contract's logic with malicious code designed to steal funds. Notably, Wasabi lacked a timelock or multisig to protect the admin role, leaving a single key with full control over the protocol. Blockaid's detection system identified the ongoing admin-key compromise exploit on Wasabi Protocol across both Ethereum and Base. The compromised contracts include various vaults on Ethereum and Base, such as wWETH, sUSDC, and wBITCOIN. Users holding Wasabi LP tokens were advised to revoke any active approvals to the vault contracts due to the risk of drained or compromised underlying assets. This incident contributes to a cumulative DeFi loss total exceeding $770 million across over 30 reported incidents in 2026, with April accounting for the majority of these losses. Smaller breaches this month have affected several other platforms, including CoW Swap, Grinex, and Volo Protocol. A common thread among these incidents is the exploitation of known vulnerabilities, highlighting the need for improved security measures to prevent such breaches.