Wasabi Protocol Loses $4.5 Million in Admin Key Compromise

Wasabi Protocol, a perpetuals trading platform on Ethereum and Base, has been drained of approximately $4.55 million after attackers compromised its deployer admin key. This incident adds to the year's heaviest month for exploits, with DeFi losses exceeding $605 million across at least 12 incidents in April alone.

The attack on Wasabi Protocol closely mirrors the Drift Protocol exploit, which occurred on April 1 and resulted in the loss of $285 million. In both cases, the attackers used a compromised admin key to drain funds. The mechanics of the Wasabi Protocol attack involved an externally owned account (EOA) called wasabideployer.eth, which held the sole ADMIN_ROLE in Wasabi's permission system. The attacker gained access to the deployer key, granting themselves admin privileges and upgrading Wasabi's perp vaults and Long Pool to malicious implementations that drained the balances.

The exploit relied on the Universal Upgradeable Proxy Standard (UUPS), which allows a smart contract to change its underlying code while keeping the same address. However, this standard also poses a risk if an attacker controls admin permissions, as they can replace the contract's logic with malicious code. Wasabi Protocol had no timelock or multisig protecting the admin role, leaving a single key holding full control over the protocol. The cumulative DeFi loss total for 2026 has now passed $770 million across more than 30 reported incidents, with April accounting for the majority of that figure.

Users holding Wasabi LP tokens have been urged to revoke any active approvals to the vault contracts, as the underlying assets backing those tokens have either been drained or remain at risk. The incident highlights the need for DeFi protocols to implement robust security measures, such as timelocks and multisig, to prevent similar attacks in the future. Wasabi Protocol has not yet issued a public statement on the incident, which is the latest in a series of exploits that have affected the DeFi space in recent months.