Wasabi Protocol Loses Over $5 Million in Multi-Chain Exploit via Compromised Admin Key

May 1, 2026

Wasabi Protocol, a perpetuals trading platform on Ethereum and Base, lost approximately $4.55 million on April 30, 2026, after attackers compromised its deployer key and exploited admin privileges to drain funds across multiple chains including Ethereum, Base, Berachain, and Blast. The attacker used the wasabideployer.eth account, which held sole ADMIN_ROLE permissions with no timelock or multisig protection, to grant themselves admin access and upgrade vault contracts to malicious implementations that extracted balances from wWETH, sUSDC, wBITCOIN, and other vaults. Security firms PeckShield, Blockaid, and CertiK confirmed the exploit, which follows a devastating pattern of similar attacks including Drift Protocol's $285 million loss and Kelp DAO's $292 million breach earlier in April 2026. The incident contributes to over $770 million in total DeFi losses across more than 30 incidents in 2026, with April alone accounting for $605 million across at least 12 breaches, highlighting systemic vulnerabilities in single-key admin configurations.

Wasabi Protocol exploit mechanics and compromised admin key

▪Wasabi Protocol was drained of approximately $4.55 million on Thursday, April 30, 2026.

Pattern of similar DeFi exploits in April 2026

▪Volo Protocol lost $3.5 million in an April 2026 breach.
▪The cumulative DeFi loss total for 2026 has passed $770 million across more than 30 reported incidents.
▪North Korea-linked attackers used a compromised admin key to drain $285 million from Drift Protocol.
▪DeFi protocols produced over $605 million in losses across at least 12 incidents in April 2026.
▪Resolv Labs lost $23 million in an April 2026 breach.
▪April 2026 accounts for the majority of the $770 million in DeFi losses for 2026.
▪Drift Protocol lost $285 million in an exploit on April 1, 2026.