Wasabi Protocol Loses $4.5 Million in Apparent Admin Key Breach

The DeFi sector continues to experience significant losses, with Wasabi Protocol being the latest victim, suffering a loss of approximately $4.55 million on Thursday due to a compromised deployer key, as reported by security firm Blockaid. This recent hack is part of a series of incidents that have resulted in over $605 million in DeFi losses across at least 12 separate incidents this month alone. The attack bears a striking resemblance to the Drift Protocol exploit that occurred on April 1, where attackers, linked to North Korea, used a compromised admin key to drain $285 million from the Solana-based perpetuals exchange. The breach was executed through an externally owned account (EOA) known as wasabideployer.eth, which held the sole admin role within Wasabi's permission system. An EOA is a wallet that is controlled by a private key, as opposed to a smart contract, allowing the key holder to exert full control over the wallet. Once the attackers gained access to the deployer key, they swiftly granted themselves admin privileges by calling grantRole on the permission contract, without any delay. A helper contract was then utilized to upgrade Wasabi's perp vaults and Long Pool to malicious implementations, effectively draining the balances, according to Blockaid. The exploit leveraged the Universal Upgradeable Proxy Standard (UUPS), which enables a smart contract to modify its underlying code without changing its address. Although UUPS is widely adopted due to its ability to allow developers to fix bugs without requiring user migration, it also poses a significant risk if an attacker gains control of admin permissions, as they can replace the contract's logic with malicious code designed to steal funds. In the case of Wasabi, the absence of a timelock or multisig to protect the admin role made it vulnerable to such an attack, as reported by Blockaid. A timelock would have enforced a delay between the announcement and execution of an admin action, providing users with a window to react. Similarly, a multisig would have required multiple signers to approve any changes, adding an extra layer of security. However, Wasabi's reliance on a single key to hold full control over the protocol left it exposed. Following the exploit, users holding Wasabi LP tokens were advised to revoke any active approvals to the vault contracts, as the underlying assets backing these tokens were either drained or remained at risk. The cumulative DeFi loss for 2026 has now surpassed $770 million, with the majority of these losses occurring in April alone. This recent string of exploits highlights the ongoing vulnerability of the DeFi sector to similar attacks, with the common thread being the lack of implementation of lessons learned from previous incidents. Wasabi Protocol has yet to issue a public statement regarding the incident.