Wasabi Protocol Loses $4.5 Million in Apparent Admin Key Breach

The decentralized finance sector continues to suffer significant losses, with Wasabi Protocol being the latest victim, losing approximately $4.55 million on Thursday due to a compromised deployer key, according to security firm Blockaid. This incident follows a string of breaches this month, totaling over $605 million in losses across at least 12 incidents. The attack on Wasabi closely resembles the Drift Protocol exploit, where North Korea-linked attackers utilized a compromised admin key to drain $285 million from the Solana-based perpetuals exchange on April 1. The attackers gained control through an externally owned account called wasabideployer.eth, which held the sole administrative role in Wasabi's permission system. With access to the deployer key, the attackers granted themselves administrative privileges without any delay by calling grantRole on the permission contract. A helper contract was then used to upgrade Wasabi's perp vaults and Long Pool to malicious implementations, resulting in the draining of balances, as reported by Blockaid. The exploit leveraged the Universal Upgradeable Proxy Standard (UUPS), which allows a smart contract to change its underlying code while maintaining the same address. UUPS is widely used for its ability to enable developers to fix bugs without requiring user migration. However, it also poses a significant risk if an attacker gains control of admin permissions, as they can replace the contract's logic with malicious code designed to steal funds. According to Blockaid, Wasabi lacked a timelock or multisignature protection for the admin role. A timelock would have forced a delay between the announcement and execution of an admin action, providing users with time to react, while a multisignature would have required multiple signers to approve changes. The absence of these security measures left a single key with full control over the protocol. Blockaid's exploit detection system identified an ongoing admin-key compromise exploit on Wasabi Protocol across Ethereum and Base. The Wasabi Deployer EOA was used to grant the administrative role to an attacker's helper contract, which then upgraded the perp vaults and Long Pool to malicious implementations using UUPS. The compromised contracts include Wasabi's wWETH, sUSDC, wBITCOIN, wPEPE, and Long Pool vaults on Ethereum, as well as its sUSDC, wWETH, sBTC, sVIRTUAL, sAERO, and sBRETT vaults on Base, according to Blockaid. Users holding Wasabi LP tokens were advised to revoke any active approvals to the vault contracts, as the underlying assets backing those tokens had either been drained or remained at risk. A series of exploits has plagued the DeFi sector this month. In addition to the Wasabi and Drift incidents, Kelp DAO lost $292 million on April 19 when an attacker exploited a single-verifier configuration in the protocol's LayerZero bridge, releasing 116,500 unbacked rsETH that was then used as collateral to borrow real ether (ETH) from Aave. The cumulative DeFi loss total for 2026 has now exceeded $770 million across more than 30 reported incidents, with April accounting for the majority of that figure. Smaller breaches this month have hit CoW Swap ($1.2 million), Grinex ($13.74 million), Resolv Labs ($23 million), Volo Protocol ($3.5 million), among others. A common thread among these incidents is not a new vulnerability but rather the exploitation of existing security weaknesses. While each incident produces the same post-mortem language about lessons learned, the next exploit often occurs before the lessons are implemented. Wasabi has not yet issued a public statement on the incident. UPDATE (April 30, 11:34 UTC): General edits throughout. Moves Drift Protocol exploit to third paragraph.