Wasabi Protocol Suffers $4.5 Million Loss Due to Admin Key Breach

The DeFi sector continues to experience significant financial losses, with Wasabi Protocol being the latest victim. On Thursday, the platform, which is built on Ethereum and Base, was drained of approximately $4.55 million after its deployer key was compromised, according to security firm Blockaid. This incident is the latest in a series of attacks that have resulted in over $605 million in losses across at least 12 incidents in the past month. The method used in this attack bears a striking resemblance to the Drift Protocol exploit that occurred on April 1, in which North Korea-linked attackers utilized a compromised admin key to drain $285 million from the Solana-based perpetuals exchange. The attack on Wasabi Protocol was carried out through an externally owned account called wasabideployer.eth, which held the sole ADMIN_ROLE in the platform's permission system. Once the attacker gained access to the deployer key, they were able to grant themselves admin privileges without any delay by calling grantRole on the permission contract. The attacker then upgraded Wasabi's perp vaults and Long Pool to malicious implementations that drained the balances, as reported by Blockaid. The exploit relied on the Universal Upgradeable Proxy Standard (UUPS), which allows a smart contract to change its underlying code while maintaining the same address. Although UUPS is widely used as it enables developers to fix bugs without migrating users, it also has a significant downside: if an attacker gains control of admin permissions, they can replace the contract's logic with any code they desire, including code designed to steal funds. According to Blockaid, Wasabi Protocol lacked a timelock or multisig to protect the admin role. A timelock would have forced a delay between the announcement and execution of an admin action, providing users with time to react, while a multisig would have required multiple signers to approve a change. However, Wasabi had neither, leaving a single key with full control over the protocol. As a result, users who hold Wasabi LP tokens have been advised to revoke any active approvals to the vault contracts, as the underlying assets backing those tokens have either been drained or remain at risk. The past month has seen a series of exploits, including the Drift Protocol breach, in which attackers exploited a single-key admin setup with no governance timelock, listing a fake token as collateral and raising withdrawal limits to drain real assets in approximately 12 minutes. On April 19, Kelp DAO lost $292 million when an attacker exploited a single-verifier configuration in the protocol's LayerZero bridge, releasing 116,500 unbacked rsETH that was then used as collateral to borrow real ether (ETH) from Aave. The cumulative DeFi loss total for 2026 has now surpassed $770 million across more than 30 reported incidents, with April alone accounting for the majority of that figure. Other smaller breaches that have occurred this month include CoW Swap ($1.2 million), Grinex ($13.74 million), Resolv Labs ($23 million), and Volo Protocol ($3.5 million), among others. A common thread among these incidents is not a new vulnerability, but rather the repetition of similar post-mortem language about lessons learned, only to be followed by another exploit before the lessons can be implemented. Wasabi Protocol has yet to issue a public statement regarding the incident.