Wasabi Protocol Loses $4.55 Million Due to Compromised Admin Key

Wasabi Protocol, a perpetuals trading platform built on Ethereum and Base, suffered a hack resulting in the loss of around $4.55 million on April 30, 2026. The attackers exploited a compromised admin key that allowed them to grant themselves admin privileges without any safeguards, such as a timelock or multisignature (multisig) requirements. Once they gained access, the perpetrators used this key to upgrade Wasabi’s vault contracts to malicious versions that drained funds from multiple liquidity pools.

The attack employed principles similar to those seen in recent exploits at Drift Protocol and Kelp DAO, both of which involved compromised keys and inadequate security measures. Within 2026, vulnerabilities in decentralized finance (DeFi) protocols have led to over $770 million in losses, with approximately $605 million lost due to at least a dozen incidents just in April. Notably, the Drift Protocol hack earlier in the month involved a $285 million loss through a similar attack vector using a compromised admin key.

In the case of Wasabi, the exploit utilized an externally owned account (EOA) identified as wasabideployer.eth, which held sole admin control over the protocol's permission system. Without a multisig — which requires multiple sign-offs for crucial actions — or a timelock that would delay changes, a single keyholder had complete control, which proved detrimental when the key was compromised.

Notable contracts affected by the attack include vaults for wWETH, sUSDC, and wBITCOIN, among others across both Ethereum and Base networks. Blockaid, a security firm that analyzed the situation, recommended that users holding Wasabi liquidity provider (LP) tokens revoke any active approvals to the vault contracts due to the risks posed by drained assets.

The frequency and scale of such attacks highlight ongoing vulnerabilities within the DeFi landscape, raising questions about protocol security practices and the seemingly repetitive pattern of learning from these incidents without implementing effective safeguards. As Wasabi has not issued a public statement regarding the breach, industry participants are left to contemplate the effectiveness of existing security measures and governance practices in DeFi.

In light of continued breaches, it is critical for the community to prioritize the establishment of robust security protocols to minimize the risk of similar incidents in the future, as the DeFi sector's struggle with security vulnerabilities continues unabated.