{
 "tag": "deployer-key",
 "name": "Deployer Key",
 "group": "Other",
 "incidents": [
  {
   "slug": "wasabi-protocol-deployer-key-apr-2026",
   "title": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key",
   "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026",
   "json": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum",
    "base"
   ],
   "method": "key-leak",
   "product": "Wasabi Protocol vaults and LP holders (Ethereum, Base)",
   "tags": [
    "ethereum",
    "base",
    "key-leak",
    "wasabi-protocol",
    "admin-key",
    "deployer-key",
    "proxy-upgrade",
    "perps",
    "blockaid"
   ],
   "amountUsd": 4550000,
   "victims": null,
   "startedAt": "2026-04-30",
   "closedAt": "2026-04-30",
   "updatedAt": "2026-04-30T12:00:00Z",
   "summary": "On 30 April 2026 an attacker used the compromised key of wasabideployer.eth, an ordinary wallet that held Wasabi's only ADMIN_ROLE, to grant themselves admin rights with no delay. A helper contract then upgraded the perp vaults and Long Pool on Ethereum and Base to malicious code that emptied them. CoinDesk put losses at about $4.55M; Blockaid flagged the attack. Wasabi LP holders were urged to revoke approvals to the vault contracts."
  }
 ],
 "changes": [
  {
   "incident": "wasabi-protocol-deployer-key-apr-2026",
   "incidentTitle": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-30",
   "title": "The attacker used the compromised wasabideployer.eth key to call grantRole and give themselves admin privileges with no delay.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise",
   "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026"
  },
  {
   "incident": "wasabi-protocol-deployer-key-apr-2026",
   "incidentTitle": "Wasabi Protocol vaults drained of $4.5M after attacker uses a compromised deployer admin key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-04-30",
   "title": "A helper contract upgraded the perp vaults and Long Pool to malicious implementations that drained balances on Ethereum and Base; Blockaid flagged the exploit on X.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise",
   "url": "https://drains.watch/i/wasabi-protocol-deployer-key-apr-2026"
  }
 ]
}