{
 "slug": "wasabi-protocol-deployer-key-apr-2026",
 "title": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key",
 "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026",
 "json": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "ethereum",
  "base"
 ],
 "method": "key-leak",
 "product": "Wasabi Protocol vaults and LP holders (Ethereum, Base)",
 "tags": [
  "ethereum",
  "base",
  "key-leak",
  "wasabi-protocol",
  "admin-key",
  "deployer-key",
  "proxy-upgrade",
  "perps",
  "blockaid"
 ],
 "amountUsd": 4550000,
 "victims": null,
 "startedAt": "2026-04-30",
 "closedAt": "2026-04-30",
 "updatedAt": "2026-04-30T12:00:00Z",
 "summary": "On 30 April 2026 an attacker used the compromised key of wasabideployer.eth, an ordinary wallet that held Wasabi's only ADMIN_ROLE, to grant themselves admin rights with no delay. A helper contract then upgraded the perp vaults and Long Pool on Ethereum and Base to malicious code that emptied them. CoinDesk put losses at about $4.55M; Blockaid flagged the attack. Wasabi LP holders were urged to revoke approvals to the vault contracts.",
 "timeline": [
  {
   "date": "2026-04-30",
   "title": "The attacker used the compromised wasabideployer.eth key to call grantRole and give themselves admin privileges with no delay.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise"
  },
  {
   "date": "2026-04-30",
   "title": "A helper contract upgraded the perp vaults and Long Pool to malicious implementations that drained balances on Ethereum and Base; Blockaid flagged the exploit on X.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Wasabi Protocol drained of $4.5 million in apparent admin key compromise",
   "url": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise",
   "publisher": "CoinDesk",
   "date": "2026-04-30"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you hold Wasabi vault or LP tokens (wWETH, sUSDC, wBITCOIN, wPEPE or Long Pool on Ethereum; sUSDC, wWETH, sBTC, sVIRTUAL, sAERO or sBRETT on Base) or have open approvals to Wasabi vault contracts.\n\n## What to do now\n- Revoke any active approvals to Wasabi vault contracts.\n- Follow Wasabi's official channels for any recovery plan and ignore DMs offering refunds.\n\n## How to avoid this\n- Before depositing, check who can upgrade the contracts. One ordinary wallet as admin with no timelock means a single stolen key can empty the vaults.\n- Prefer protocols where upgrades need a multisig and a public timelock.",
 "notes": null,
 "agentBrief": "# Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key\n\n- Severity: Critical · Status: Still active (past)\n- Chains: Ethereum, Base · Method: Leaked private keys and seed phrases\n- Started: Apr 30, 2026 · Last update: Apr 30, 2026 · Reported stolen: $4.5M\n- Who/what: Wasabi Protocol vaults and LP holders (Ethereum, Base)\n\nOn 30 April 2026 an attacker used the compromised key of wasabideployer.eth, an ordinary wallet that held Wasabi's only ADMIN_ROLE, to grant themselves admin rights with no delay. A helper contract then upgraded the perp vaults and Long Pool on Ethereum and Base to malicious code that emptied them. CoinDesk put losses at about $4.55M; Blockaid flagged the attack. Wasabi LP holders were urged to revoke approvals to the vault contracts.\n\n## Am I affected?\nIf you hold Wasabi vault or LP tokens (wWETH, sUSDC, wBITCOIN, wPEPE or Long Pool on Ethereum; sUSDC, wWETH, sBTC, sVIRTUAL, sAERO or sBRETT on Base) or have open approvals to Wasabi vault contracts.\n\n## What to do now\n- Revoke any active approvals to Wasabi vault contracts.\n- Follow Wasabi's official channels for any recovery plan and ignore DMs offering refunds.\n\n## How to avoid this\n- Before depositing, check who can upgrade the contracts. One ordinary wallet as admin with no timelock means a single stolen key can empty the vaults.\n- Prefer protocols where upgrades need a multisig and a public timelock.\n\n## Sources\n- Wasabi Protocol drained of $4.5 million in apparent admin key compromise (CoinDesk, 2026-04-30): https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise\n\nFull record: https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026 · JSON: https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}