Wasabi Protocol exploit tied to admin key breach, $5M+ drained across chains

Wasabi Protocol has paused activity after reports of a multi-chain exploit affecting its contracts.

Blockchain security firm PeckShield estimated losses of more than $5 million, with funds reportedly drained across Ethereum, Base, Berachain, and Blast.

The protocol acknowledged the incident, stating it is investigating the issue and urging users not to interact with its contracts until further notice.

Admin key compromise identified as root cause

Further analysis from Blockaid suggests the attack stemmed from a compromised deployer key rather than a direct smart contract vulnerability.

According to Blockaid, the attacker used the compromised key to grant administrative privileges to a malicious contract. This allowed them to upgrade core components, including vaults and liquidity pools, to a harmful implementation that drained user funds.

The exploit leveraged upgradeable contract architecture, enabling the attacker to replace legitimate logic with malicious code once admin access was obtained.

Multi-chain deployment amplified impact

The exploit affected Wasabi deployments across multiple chains, allowing the attacker to replicate the attack pattern across environments.

This multi-chain exposure increased the scale of the incident, as similar contract structures were targeted on each network.

Transaction data shared by security firms shows funds moving from affected vaults to attacker-controlled addresses. However, full loss figures have not been confirmed by the protocol.

LP tokens flagged as compromised

Blockaid warned that liquidity provider [LP] tokens tied to affected vaults should be treated as compromised.

While users may still see balances in their wallets, the underlying assets have been drained or are at risk, leaving those tokens with little to no redemption value.

Security firms also advised users to revoke approvals linked to Wasabi contracts to prevent further exposure.

Investigation underway as April exploit trend continues

Wasabi said it is working with external security teams, including SEAL 911 and Blockaid, to investigate the incident and trace funds.

The exploit adds to a growing list of incidents this month, which has seen multiple DeFi protocols affected by attacks ranging from contract flaws to key compromises.

The pattern underscores persistent risks across DeFi infrastructure, particularly where access controls and upgrade mechanisms are not sufficiently secured.

Final Summary

• Wasabi Protocol suffered a multi-chain exploit, with security firms linking the attack to an admin key compromise that enabled malicious contract upgrades.
• The incident highlights ongoing DeFi security risks, with April seeing a wave of exploits across protocols and attack vectors.