Wasabi Protocol Loses $4.5 Million to Apparent Admin Key Breach

The DeFi sector continues to experience significant losses, with Wasabi Protocol being the latest to fall victim to a substantial breach. On Thursday, the platform, which operates on Ethereum and Base, was drained of approximately $4.55 million after its deployer key was compromised, according to a report by security firm Blockaid. This incident follows a string of exploits this month, including the Drift Protocol breach on April 1, where a compromised admin key was used to drain $285 million from the Solana-based perpetuals exchange. The attack on Wasabi Protocol was carried out through an externally owned account called wasabideployer.eth, which held the sole admin role in the platform's permission system. Once the attacker gained access to the deployer key, they were able to grant themselves admin privileges without any delay by calling grantRole on the permission contract. The attacker then used a helper contract to upgrade Wasabi's perp vaults and Long Pool to malicious implementations, resulting in the draining of user balances. The exploit leveraged the Universal Upgradeable Proxy Standard (UUPS), which allows a smart contract to change its underlying code while maintaining the same address. However, this standard also poses a significant risk if an attacker gains control of admin permissions, as they can replace the contract's logic with malicious code designed to steal funds. A critical factor in this breach was the lack of a timelock or multisig protection for the admin role, which would have introduced a delay between the announcement and execution of admin actions or required multiple signers to approve changes, respectively. The absence of these security measures allowed a single key to hold full control over the protocol, leaving it vulnerable to exploitation. The compromised contracts include various vaults on both Ethereum and Base, and users holding Wasabi LP tokens have been advised to revoke any active approvals to the vault contracts to mitigate further risk. This incident is part of a larger trend of DeFi exploits this month, which have collectively resulted in over $605 million in losses across at least 12 incidents. Other notable breaches include the $292 million loss suffered by Kelp DAO due to a single-verifier configuration exploit in its LayerZero bridge. The cumulative DeFi loss total for 2026 has now surpassed $770 million, with April accounting for the majority of these losses. Despite the repetition of similar vulnerabilities and post-mortem analyses emphasizing lessons learned, the frequency and severity of these incidents continue to pose significant challenges to the DeFi sector.