Breaches and incidentsBriefChecked against a primary source
Wasabi Protocol: single deployer key with full admin drained vaults on three chains
07:36 to about 07:50 UTC (reported 30 Apr to 1 May 2026): about USD 5M from Ethereum, Base and Blast (estimates USD 4.5M to 5.9M).
- Disclosed
What happened
- Root cause per Hypernative: one deployer key held admin over every PerpManager with no timelock or co-signer. It granted admin to a pre-computed attacker contract, which used strategyDeposit (any destination accepted) and replaced pool implementations. “No vulnerability in the smart contract code was found or exploited.” How the key was compromised is not disclosed.
- Attribution: none.
- Response: contracts paused, SEAL-911 engaged, no compensation plan at the time. Hypernative’s detection flagged the attacker contract about three minutes before the first drain, but Wasabi was not a customer.
Sources
- https://hypernative.io/blog/when-the-deployer-key-is-the-only-admin-how-one-compromised-wallet-drained-5m-from-wasabi-perp-across-three-chains
- https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.