Wasabi Protocol Suffers $4.5 Million Loss Due to Compromised Admin Key

The DeFi sector continues to face significant losses, with Wasabi Protocol being the latest victim, having lost approximately $4.55 million on Thursday due to a compromised deployer key, as reported by security firm Blockaid. This incident marks another major loss in a month that has seen over $605 million in DeFi losses across more than 12 separate incidents. The attack bears a striking resemblance to the Drift Protocol exploit, which occurred on April 1 and saw North Korea-linked attackers utilize a compromised admin key to drain $285 million from the Solana-based perpetuals exchange. The attack was facilitated through an externally owned account known as wasabideployer.eth, which held the sole ADMIN_ROLE within Wasabi's permission system. An EOA is a wallet controlled by a private key, and whoever possesses this key has control over the wallet. Once the attacker gained access to the deployer key, they granted themselves admin privileges with no delay by calling grantRole on the permission contract. The attacker then used a helper contract to upgrade Wasabi's perp vaults and Long Pool to malicious implementations, which drained the balances, according to Blockaid. The exploit relied on the Universal Upgradeable Proxy Standard (UUPS), which allows a smart contract to alter its underlying code without changing its address. UUPS is widely used as it enables developers to fix bugs without migrating users. However, the downside is that if an attacker gains control of admin permissions, they can replace the contract's logic with any code they desire, including code designed to steal funds. Wasabi lacked a timelock or multisig to protect the admin role, as reported by Blockaid. A timelock enforces a delay between the announcement and execution of an admin action, giving users time to react, while a multisig requires multiple signers to approve a change. Wasabi had neither, leaving a single key with full control over the protocol. Blockaid's exploit detection system identified an ongoing admin-key compromise exploit on @wasabi_protocol across Ethereum and Base. The Wasabi: Deployer EOA was used to grant ADMIN_ROLE to an attacker helper contract, which then UUPS-upgraded the perp vaults and LongPool to malicious implementations. The compromised contracts include Wasabi's wWETH, sUSDC, wBITCOIN, wPEPE, and Long Pool vaults on Ethereum, as well as its sUSDC, wWETH, sBTC, sVIRTUAL, sAERO, and sBRETT vaults on Base, according to Blockaid. Users holding Wasabi LP tokens were advised to revoke any active approvals to the vault contracts, as the underlying assets backing those tokens had either been drained or remained at risk. A series of exploits has occurred in recent weeks, with Drift Protocol being a notable example. In that case, attackers exploited a single-key admin setup with no governance timelock, listing a fake token as collateral and raising withdrawal limits to drain real assets in approximately 12 minutes. Three weeks later, on April 19, Kelp DAO lost $292 million when an attacker exploited a single-verifier configuration in the protocol's LayerZero bridge, releasing 116,500 unbacked rsETH that was then used as collateral to borrow real ether (ETH) from Aave. The total DeFi loss for 2026 has now exceeded $770 million across more than 30 reported incidents, with April accounting for the majority of that figure. Smaller breaches this month have hit CoW Swap ($1.2 million), Grinex ($13.74 million), Resolv Labs ($23 million), Volo Protocol ($3.5 million), among others. What ties these incidents together is not a new vulnerability, but rather the same post-mortem language about lessons learned, only for the next exploit to occur before those lessons are implemented. Wasabi has yet to issue a public statement regarding the incident. UPDATE (April 30, 11:34 UTC): General edits throughout. Moves Drift Protocol exploit to third paragraph.