Wasabi Protocol Suffers $4.5 Million Loss Due to Admin Key Breach

The DeFi sector continues to experience significant losses, with Wasabi Protocol being the latest victim, losing approximately $4.55 million on Thursday after its deployer key was compromised, according to security firm Blockaid. This incident occurred on the Ethereum and Base platforms, which Wasabi Protocol utilizes for its perpetuals trading. The attack's methodology closely resembles the Drift Protocol exploit that happened earlier this month, where $285 million was drained from the Solana-based perpetuals exchange by North Korea-linked attackers who utilized a compromised admin key. The attack was carried out through an externally owned account (EOA) named wasabideployer.eth, which possessed the sole ADMIN_ROLE within Wasabi's permission system. An EOA is essentially a wallet controlled by a private key, distinct from a smart contract, where the holder of the key has full control over the wallet. Upon gaining access to the deployer key, the attackers granted themselves admin privileges without any delay by invoking grantRole on the permission contract. Subsequently, their helper contract upgraded Wasabi's perp vaults and Long Pool to malicious implementations, resulting in the drainage of the balances, as reported by Blockaid. The exploit leveraged the Universal Upgradeable Proxy Standard (UUPS), a standard that enables a smart contract to modify its underlying code while retaining the same address. Although UUPS is widely adopted for its convenience in fixing bugs without requiring user migration, it also poses a significant risk if an attacker gains control of admin permissions, as they can replace the contract's logic with malicious code designed to steal funds. It was noted by Blockaid that Wasabi lacked a timelock or multisig to protect the admin role. A timelock would have enforced a delay between the announcement and execution of an admin action, providing users with a window to react. Similarly, a multisig would have required multiple signers to approve a change, enhancing security. However, Wasabi had neither, leaving a single key with unfettered control over the protocol. The compromised contracts include various vaults on both Ethereum and Base, such as wWETH, sUSDC, wBITCOIN, and others, according to Blockaid. Users holding Wasabi LP tokens were advised to revoke any active approvals to the vault contracts, as the underlying assets had either been drained or were at risk. This incident is part of a larger trend of exploits in the DeFi space, with April alone accounting for a significant portion of the cumulative $770 million loss across over 30 incidents in 2026. Other notable breaches this month include CoW Swap, Grinex, Resolv Labs, and Volo Protocol, among others. A common thread among these incidents is not a new vulnerability but rather the repeated exploitation of known weaknesses, with each post-mortem analysis highlighting lessons learned, yet the next exploit often occurs before these lessons can be implemented. Wasabi Protocol has not yet released a public statement regarding the incident. UPDATE (April 30, 11:34 UTC): General edits have been made throughout, and the mention of the Drift Protocol exploit has been moved to the third paragraph.