An attacker drained roughly $5 million from Wasabi Protocol on April 30 after compromising its admin private key. The Wasabi Protocol hack hit vaults across Ethereum, Base, Blast, and Berachain. Liquidity providers now hold tokens they cannot redeem. It is the third major key-compromise exploit in April, each time following the same script.
How the admin key exploit drained four chains
The attacker gained control of wasabideployer.eth, the wallet holding sole admin authority over the protocol. With no multisig or timelock in place, they faced no delays. They called grantRole on the permission contract, granting themselves instant admin access. From there, they used UUPS to replace Wasabi’s vault contracts with malicious versions that drained the balances.
UUPS, or Universal Upgradeable Proxy Standard, lets developers update smart contract logic without migrating users. The trade-off is severe: whoever holds admin access can change what the contracts do. Wasabi handed that control to one private key, with nothing else required.
Security firm Blockaid noted the attacker pre-funded the admin wallets through Tornado Cash before striking. That detail suggests the attacker came prepared. After draining the vaults, the attacker converted the funds to ETH and routed them back through Tornado Cash.
LP tokens are worth nothing now
For Wasabi’s liquidity providers, the damage is immediate and total. The exploit wiped out every token/" data-term-title="LP Token" role="button" tabindex="0">LP token from the compromised vaults. Users’ wallets may still show a balance, but the underlying assets are gone. There is nothing left to redeem. Security researchers advised anyone with active approvals to revoke them immediately. Virtuals Protocol, which uses Wasabi to launch AI agent tokens, confirmed its funds were not affected and paused all vault interactions as a precaution.
April has been a disaster for DeFi
Wasabi is the third major protocol this month to fall to a compromised admin key. Drift Protocol lost $285 million on April 1 when North Korea-linked attackers used the same technique on Solana. Kelp DAO followed on April 19, losing $292 million through a different vulnerability. Yet the same underlying failure applied: too few people needed to approve a critical change.
April alone has produced over $600 million in DeFi exploit losses across at least 12 incidents. The 2026 total has now passed $770 million. On-chain analyst @DefiIgnas has suggested the pattern is not random. He argues attackers are using AI to scan for lightly protected vaults and target them systematically.
The tools are getting smarter but the safeguards don’t seem to be keeping up!
