Perpetuals platform Wasabi Protocol lost roughly $4.5 million on Thursday after attackers compromised an admin key controlling its Ethereum (ETH) and Base vault contracts.
Wasabi Exploit Details
The breach was first flagged by security firm Blockaid, which traced the loss to a deployer wallet that held the sole ADMIN_ROLE in Wasabi's permission system.
The attacker called grantRole on that contract, handed admin rights to a helper contract, and pushed a UUPS upgrade on the perp vaults and LongPool. Malicious implementations then drained balances across both chains.
Affected pools included wWETH, sUSDC, wBITCOIN, wPEPE and Long Pool vaults on Ethereum, alongside sUSDC, sBTC, sAERO and others on Base, CertiK reported. Wasabi held no timelock or multisig over the admin role.
Also Read: Standard Chartered Says DeFi's $300M Rescue After KelpDAO Hack Could Become Its 'Antifragile Moment'
Single-Key Risk Repeats
Analysts say the playbook is familiar. The attack closely tracks the April 1 breach at Drift Protocol, where a compromised admin key drained $285 million on Solana (SOL) in roughly 12 minutes.
Weeks later, Kelp DAO lost $292 million through a single-verifier flaw in its LayerZero bridge.
April alone has now produced more than $605 million in DeFi losses across at least 12 incidents, lifting the 2026 tally past $770 million. Smaller breaches at CoW Swap, Grinex, Resolv Labs and Volo Protocol have piled on through the same month.
Read Next: Ultima Token Posts $11.4M Daily Volume As Price Holds Near $2,965