Wasabi Protocol Loses $4.5 Million Due to Compromised Admin Key

The DeFi space continues to experience significant losses, with Wasabi Protocol being the latest victim, having lost approximately $4.55 million on Thursday due to a compromised deployer key, as reported by security firm Blockaid. The incident is part of a larger trend, with over $605 million in DeFi losses across at least 12 incidents this month alone. The mechanics of the attack involved an externally owned account, wasabideployer.eth, holding the sole ADMIN_ROLE in Wasabi's permission system. The attacker gained access to the deployer key and granted themselves admin privileges, then upgraded Wasabi's perp vaults and Long Pool to malicious implementations, draining the balances. The exploit utilized the Universal Upgradeable Proxy Standard (UUPS), which allows smart contracts to change their underlying code while maintaining the same address. However, this standard can be exploited if an attacker gains admin permissions, allowing them to replace the contract's logic with malicious code. Wasabi lacked a timelock or multisig to protect the admin role, leaving a single key with full control over the protocol. Blockaid's exploit detection system identified the ongoing admin-key compromise exploit, and users holding Wasabi LP tokens were urged to revoke any active approvals to the vault contracts. This incident is part of a larger series of exploits, including the Drift Protocol breach, which also involved a compromised admin key with no governance timelock. The cumulative DeFi loss total for 2026 has now surpassed $770 million across over 30 reported incidents, with April accounting for the majority of that figure. Other breaches this month include CoW Swap, Grinex, Resolv Labs, and Volo Protocol, among others. A common thread among these incidents is the lack of implementation of lessons learned, with each exploit producing similar post-mortem language.