Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key
Wasabi Protocol vaults and LP holders (Ethereum, Base)
On 30 April 2026 an attacker used the compromised key of wasabideployer.eth, an ordinary wallet that held Wasabi's only ADMIN_ROLE, to grant themselves admin rights with no delay. A helper contract then upgraded the perp vaults and Long Pool on Ethereum and Base to malicious code that emptied them. CoinDesk put losses at about $4.55M; Blockaid flagged the attack. Wasabi LP holders were urged to revoke approvals to the vault contracts.
Why this severity: $4.5M reported stolen, still active.
- Started
- Apr 30, 2026
- Closed
- Apr 30, 2026
- Reported stolen
- $4.5M
At risk
- Wasabi Protocol vaults and LP holders (Ethereum, Base)
- Ethereum wallets
- Base wallets
What to do now
- Revoke any active approvals to Wasabi vault contracts.
- Follow Wasabi's official channels for any recovery plan and ignore DMs offering refunds.
Stay safe
Am I affected?
If you hold Wasabi vault or LP tokens (wWETH, sUSDC, wBITCOIN, wPEPE or Long Pool on Ethereum; sUSDC, wWETH, sBTC, sVIRTUAL, sAERO or sBRETT on Base) or have open approvals to Wasabi vault contracts.
What to do now
- Revoke any active approvals to Wasabi vault contracts.
- Follow Wasabi's official channels for any recovery plan and ignore DMs offering refunds.
How to avoid this
- Before depositing, check who can upgrade the contracts. One ordinary wallet as admin with no timelock means a single stolen key can empty the vaults.
- Prefer protocols where upgrades need a multisig and a public timelock.
Timeline 2
A helper contract upgraded the perp vaults and Long Pool to malicious implementations that drained balances on Ethereum and Base; Blockaid flagged the exploit on X.
SourceThe attacker used the compromised wasabideployer.eth key to call grantRole and give themselves admin privileges with no delay.
Source
News & write-ups ›1
How this method works
A private key or seed phrase ends up somewhere readable: code on GitHub, an env file, a hacked server or cloud notes. Bots find it within minutes. Read about leaked private keys and seed phrases →
Follow new drains and updates in your feed reader or Telegram RSS bot.