Wasabi Protocol Loses $4.5 Million Due to Apparent Admin Key Compromise

The DeFi sector continues to experience significant financial losses, with Wasabi Protocol being the latest victim. On Thursday, the protocol, which operates as a perpetuals trading platform on Ethereum and Base, was drained of approximately $4.55 million after its deployer key was compromised, according to a report by security firm Blockaid. This incident is the latest in a series of breaches that have resulted in over $605 million in DeFi losses across at least 12 incidents this month. The attack bears a striking resemblance to the Drift Protocol exploit that occurred on April 1, in which North Korea-linked attackers utilized a compromised admin key to steal $285 million from the Solana-based perpetuals exchange. The attack was carried out through an externally owned account called wasabideployer.eth, which possessed the sole ADMIN_ROLE in Wasabi's permission system. An externally owned account is a wallet controlled by a private key, as opposed to a smart contract. The individual who holds the key has control over the wallet. Once the attacker gained access to the deployer key, they granted themselves admin privileges without delay by calling grantRole on the permission contract. The attacker's helper contract then upgraded Wasabi's perp vaults and Long Pool to malicious implementations, draining the balances, as reported by Blockaid. The exploit relied on the Universal Upgradeable Proxy Standard (UUPS), which allows a smart contract to modify its underlying code while maintaining the same address. UUPS is widely used because it enables developers to fix bugs without requiring users to migrate. However, if an attacker gains control of admin permissions, they can replace the contract's logic with any code they choose, including code designed to steal funds. According to Blockaid, Wasabi lacked a timelock or multisig to protect the admin role. A timelock imposes a delay between the announcement and execution of an admin action, providing users with time to react. A multisig requires multiple signers to approve a change. Wasabi had neither, leaving a single key with complete control over the protocol. Blockaid's exploit detection system identified an ongoing admin-key compromise exploit on Wasabi Protocol across Ethereum and Base. The Wasabi: Deployer EOA was used to grant ADMIN_ROLE to an attacker helper contract, which then UUPS-upgraded the perp vaults and LongPool to malicious implementations. The compromised contracts include Wasabi's wWETH, sUSDC, wBITCOIN, wPEPE, and Long Pool vaults on Ethereum, as well as its sUSDC, wWETH, sBTC, sVIRTUAL, sAERO, and sBRETT vaults on Base, according to Blockaid. Users holding Wasabi LP tokens were advised to revoke any active approvals to the vault contracts, as the underlying assets backing those tokens had either been drained or remained at risk. A series of exploits has occurred this month. In the case of Drift, the attackers also exploited a single-key admin setup with no governance timelock, listing a fake token as collateral and raising withdrawal limits to drain real assets in approximately 12 minutes. Three weeks later, on April 19, Kelp DAO lost $292 million when an attacker exploited a single-verifier configuration in the protocol's LayerZero bridge, releasing 116,500 unbacked rsETH that was then used as collateral to borrow real ether (ETH) from Aave. The cumulative DeFi loss total for 2026 has now exceeded $770 million across more than 30 reported incidents. April alone accounts for the majority of this figure. Smaller breaches this month have affected CoW Swap ($1.2 million), Grinex ($13.74 million), Resolv Labs ($23 million), Volo Protocol ($3.5 million), among others. What ties these incidents together is not a new vulnerability. Each incident produces the same post-mortem language about lessons learned, but the next exploit usually occurs before the lessons are implemented. Wasabi has not yet issued a public statement regarding the incident. UPDATE (April 30, 11:34 UTC): General edits throughout. Moves Drift Protocol exploit to third paragraph.