Apr 30, 2026
1 new drain, 1 update.
New
-
Critical✕Still active
Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key
On 30 April 2026 an attacker used the compromised key of wasabideployer.eth, an ordinary wallet that held Wasabi's only ADMIN_ROLE, to grant themselves admin rights with no delay. A helper contract then upgraded the perp vaults and Long Pool on Ethereum and Base to malicious code that emptied them. CoinDesk put losses at about $4.55M; Blockaid flagged the attack. Wasabi LP holders were urged to revoke approvals to the vault contracts.
Wasabi Protocol vaults and LP holders (Ethereum, Base)·Ethereum, Base·$4.5M stolen·Since Apr 30, 2026·
Updated
-
Critical✓Contained
Meteora loses $1.5M USDC to fake OTC escrow in double-impersonation scam
On Jan 17, 2026, the Solana DEX Meteora sent $1.5 million in USDC to what it believed was a trusted escrow wallet for an OTC buyback of its MET token. Scammers had impersonated the seller to Meteora and Meteora to the seller, so the 'escrow' address was theirs. The funds were reportedly moved through KuCoin. No smart contract was exploited and no user funds were involved. Meteora disclosed the loss in its Q1 2026 token holder report. Teams doing OTC deals should confirm counterparties and escrow addresses over a separate, known channel.
Meteora treasury (OTC buyback of MET)·Solana·$1.5M stolen·Since Jan 17, 2026·