Wasabi Protocol loses $5M in admin key exploit

Wasabi Protocol, a decentralized perpetuals trading platform, lost approximately $5 million in a multichain exploit after attackers compromised its deployer admin key, security firms Blockaid and PeckShield reported Thursday.

The attack spanned Ethereum, Base, Berachain, and Blast, targeting the platform's perpetuals vaults and Long Pool. Blockchain analysts said the intruder accessed the wasabideployer.eth externally owned account, the sole holder of the ADMIN_ROLE in Wasabi's permission system. Using that key, the attacker instantly granted admin privileges to a helper contract with no delay, then upgraded core contracts to malicious versions via the Universal Upgradeable Proxy Standard, or UUPS. This allowed the drainage of user balances from vaults holding assets including wWETH, sUSDC, wBITCOIN, wPEPE, sBTC, sVIRTUAL, sAERO, and sBRETT.

"All Wasabi/Spicy LPshare tokens minted by these vaults should be treated as COMPROMISED," Blockaid warned on X, noting that underlying assets had been drained or remained at risk while the deployer key stayed active. Users holding liquidity provider tokens were urged to revoke approvals to the affected contracts immediately. Stolen funds,...