CryptoReal
CASE FILE — May 4, 2026

One Compromised Key Drained $5.9 Million From Wasabi Protocol Across Four Chains

YT By Yuki Tanaka May 4, 2026 14 min read

In the early hours of April 30, 2026, an attacker who already held the private key to Wasabi Protocol's sole administrative wallet put that key to use. Within roughly three minutes, more than a dozen vaults across four blockchains — Ethereum, Base, Berachain, and Blast — were emptied for a combined $5.9 million, according to QuillAudits' final tally. PeckShield reported that the attacker had obtained the key to Wasabi's admin wallet before the drain began.

Technically speaking, nothing was "hacked." No bug was discovered and no smart contract malfunctioned. The attacker used an authorized key exactly as the system was built to allow, and Wasabi's vault infrastructure complied without objection.

The wallet behind it all, known on-chain as wasabideployer.eth, held unrestricted ADMIN_ROLE permissions over every upgradeable vault the protocol had ever deployed. There was no multisig sharing that authority, no timelock delaying its use, and no governance vote required — a single key controlled everything.

Blockaid's monitoring system detected the drain as it happened, and CertiK's alerts followed within minutes. On-chain observers watched 840.9 WETH — about $1.9 million — leave a single vault in one transaction, with seven more vaults drained in the same block. The identical script ran simultaneously on Ethereum, Base, Berachain, and Blast, operated by the same controller.

Wasabi's first public comment didn't surface until hours into the incident, stating only that the team was aware of a problem, was investigating, and asked users to avoid the contracts.

Researchers ZachXBT and the pseudonymous Cos quickly identified what mattered most: this wasn't really a story about a stolen credential, it was a story about a protocol architected so that stealing one credential was all it took.

April 2026 has been described as the worst month for DeFi on record. Drift lost $285 million on April 1, and KelpDAO lost $290 million on April 18. Wasabi's losses added to a monthly total already past $635 million — and the common thread across these incidents isn't growing technical sophistication. It's the same simple failure, repeated.

01Security Firms Moved Faster Than the Team Itself

Blockaid was first to respond, flagging an active drain across Ethereum and Base early on April 30, naming the attacker's wallet address, describing the mechanism, and publishing the relevant transaction hashes — all while most of Wasabi's user base was likely still asleep.

At that point, Blockaid's running estimate of extracted funds stood at roughly $4.55 million, with the investigation ongoing and Berachain and Blast not yet confirmed as affected chains.

About an hour later, Hypernative issued high-severity alerts describing the incident as "Wasabi Perp Drained for ~$5M+ Across Three Chains via Deployer Key Compromise," expanding the picture beyond what had been mapped so far.

Cyvers separately identified the Tornado Cash-linked funding address behind the attack and flagged the pattern of consolidating stolen assets into ETH. Blocksec's Phalcon platform published detailed transaction traces covering both chains.

It took more than two hours after Blockaid's initial alert for Wasabi to comment publicly, and even then the statement contained no dollar figure, no explanation of the mechanism, and no mention of the attacker's wallet that three separate security firms had already published: "We're aware of an issue and are actively investigating. As a precaution, please do not interact with Wasabi contracts until further notice."

By that point, the on-chain record already showed the full shape of what had happened — 840.9 WETH pulled from the wWETH vault, seven additional vaults emptied in the same transaction, and Base compromised minutes later. By the time Wasabi's statement went live, the stolen funds were already consolidating into ETH and moving toward downstream wallets.

A second update from Wasabi arrived roughly three hours after the first alert: "We've been working with professional security teams including SEAL-911 and Blockaid. Further updates will be shared as soon as they are available. Do not interact with Wasabi contracts until further notice." Across both statements and three hours, the team disclosed no loss total, no transaction hash, and nothing that wasn't already visible on-chain.

Independent researchers filled the void. ZachXBT called out the single-key failure within the hour. Francesco Andreoli published a technical breakdown covering the mechanics, warning LP holders and recommending they use RevokeCash — before Wasabi had even posted its second update.

PeckShield subsequently confirmed the attack had also reached Berachain and Blast, and QuillAudits later totaled the combined losses across all four chains at $5.9 million.

Blockaid's most actionable follow-up warned any wallet holding Wasabi or "Spicy" LP-share tokens that the underlying collateral was gone, redemption value was effectively zero, and the tokens should be treated as compromised for as long as the deployer key stayed active.

Notably, Virtuals Protocol — which had integrated with Wasabi to let more than 50 AI trading agents route leveraged positions — reacted faster than Wasabi itself. Before Wasabi's second statement appeared, Virtuals had already frozen all Wasabi-linked margin deposits, confirmed its own systems were unaffected, and warned users against signing anything Wasabi-related.

By the end of the day, there was no post-mortem, no compensation plan, and the contracts remained paused, with SEAL-911 engaged. Five wallets that QuillAudits later confirmed belonged to the attacker, holding the full $5.9 million, sat visible on-chain — until some of the funds began exiting through Tornado Cash.

02How a Single Key Became Total Control

Wasabi wasn't broken into in any conventional sense — it was administered by someone who had no legitimate claim to the authority they were exercising.

At the root of it sat one externally owned account: wasabideployer.eth. That wallet was used to grant ADMIN_ROLE to a contract controlled by the attacker, which then upgraded the perpetual vaults and the LongPool contract to a malicious implementation designed to drain balances. It wasn't one signer among several or a single vote in a broader governance process — it was the only authority in the system, and whatever it instructed, the protocol carried out.

Relevant addresses:

How the private key moved from Wasabi's infrastructure into the attacker's hands has not been publicly explained. Phishing, malware, social engineering, or an insider are all still on the table, with nothing confirmed or ruled out.

What is documented is the sequence that followed. The attacker called grantRole() from the deployer wallet with one critical parameter set: delay=0. That single value explains the entire outcome — there was no waiting period, no advance notice, and no window for anyone to spot the pending change and react. The attacker's contract became an administrator instantly, inheriting every privilege wasabideployer.eth had held since Wasabi launched.

Role-grant transactions were executed across all four chains in sequence:

With admin control secured everywhere, the malicious contract turned to the vaults themselves. The WasabiVault proxies and the WasabiLongPool contract were upgraded through the UUPS (Universal Upgradeable Proxy Standard) pattern to implementations the attacker had already prepared. The original vault logic was replaced wholesale — the contracts still looked like Wasabi vaults, but no longer functioned as one.

Sums referenced in this case file

Each vault contained a strategyDeposit() function, normally used by an administrator to route assets into an approved yield strategy — a legitimate mechanism under ordinary operation. The attacker deployed a bare-bones fake strategy contract built for one purpose: passing strategyDeposit()'s internal checks. That function enforced no destination whitelist and performed no verification that assets remained afterward — the vaults had no way to distinguish a legitimate strategy from a malicious one.

A matching drain() function on the other end swept everything straight to the attacker's wallet. The vaults weren't broken into so much as instructed, through what looked like ordinary calls, to empty themselves.

On Ethereum, the attacker's contract looped strategyDeposit() across the vaults in a single transaction, pulling out roughly $2 million. The same pattern then ran on Base for approximately $2.5 million, and on Blast, where losses were still being reconciled at the time of reporting.

The single largest extraction was 840.9 WETH — about $1.9 million — from the wWETH vault alone.

None of this required a software bug or a new attack technique — every contract behaved exactly as it had been written to. As Francesco Andreoli summarized it: "The Wasabi Protocol exploit isn't really a story about a stolen key. It's a story about what happens when one EOA controls a batch of upgradeable vaults with no multisig, no timelock, and no DAO governance."

A multisig would have required multiple independent signatures before grantRole() could ever execute. A timelock would have forced a delay of hours or days between the grant and its activation, giving users a visible window to react. Either safeguard alone would have broken the attack chain. Wasabi had neither — the deployer key effectively was the protocol.

Blockaid also noted that the bytecode used in the attacker's orchestrator and fake strategy contracts matched patterns seen in earlier activity that had specifically targeted Wasabi. That detail suggests this wasn't an indiscriminate scan-and-exploit run against every vulnerable protocol — someone had studied Wasabi's architecture, built the malicious contracts in advance, and simply waited for access to the key. How long they held it before acting is unknown. The Tornado Cash-linked funding transaction that started the operation arrived late on April 29, but the contracts themselves could have been built days or weeks earlier — the speed and precision of the execution point away from improvisation.

03Minute-by-Minute: From Gas Funding to Fund Distribution

Preparation began about six hours before the drain. At 01:12 UTC on April 30, the attacker's wallet received 0.188 ETH from a Tornado Cash-linked address — the first funding transaction of the day, just enough to cover gas. Three more small top-ups followed between 07:07 and 07:36 UTC, from the same cluster of addresses. By 07:46 UTC, the malicious contracts were live and funded with gas on every target chain.

At 07:49:47 UTC, the Ethereum drain fired. Eight vaults were hit in the same transaction, pulling out WETH, USDC, REKT, PEPE, MOG, HarryPotterObamaSonic10Inu, ZYN, and NEIRO — everything each vault held funneled into the fake strategy contract and swept in a single call.

Confirmed Ethereum token amounts: 840.9 WETH; approximately $172K USDC; 400 billion REKT (unrelated to Rekt News); 878 million PEPE; 10 billion MOG; 36,700 HarryPotterObamaSonic10Inu; 458,000 ZYN; 1,850 NEIRO.

Conversion started immediately. Between 07:50 and 07:58 UTC, a rapid sequence of transactions unwrapped the WETH positions into native ETH as fast as blocks would allow, while the remaining tokens were swapped into ETH as well. Cyvers confirmed this consolidation pattern, followed by distribution across several addresses.

At 07:53:11 UTC, the first large transfer moved: 300.2119 ETH left the attacker's wallet and landed at what would later be identified as Hacker Wallet #2 (0xb8Bb8aDDd6b283be57b4635Bf913B34824ca70dB), in transaction 0x108e4fb1c62d8336d8e26bc58f545d1518c6b9bea8969cdff80b51692959dfde.

Two minutes and fifty seconds after the Ethereum drain, at 07:52:37 UTC, the same attacker executed the identical playbook on Base. Vaults cleared included sUSDC, wWETH, sBTC/cbBTC, sVIRTUAL, sAERO, sBRETT, sWELL, and sSKI, across two drain transactions in the same window:

Back on Ethereum, the LongPool contract was drained at 07:59:35 UTC using the same malicious implementation applied to the other vaults. Two inbound transfers of 204.37 ETH and 22.07 ETH reached the attacker's wallet at 07:59:55 and 08:01:11 UTC, the converted proceeds of that drain.

At 08:01:11 UTC, 500 ETH left the attacker's wallet in a single transaction and landed at Hacker Wallet #1. Combined with the 300 ETH sent eight minutes earlier, the bulk of the Ethereum-side proceeds had cleared the primary attack wallet before most Wasabi users had seen a single alert.

Smaller residual transfers continued through the morning as remaining token conversions completed. By 09:07 UTC, a further 28.19 ETH had moved out. A Dune dashboard built by the analyst genkisudo123 recorded 82 separate Ethereum transactions from the attacker's wallet that day, with peak ETH transfer volume concentrated between 07:00 and 09:00 UTC.

QuillAudits ultimately traced five wallets tied to the attacker, all funded within the same two-hour window:

Four of the five wallets had funneled funds through Tornado Cash via intermediary addresses by the time of reporting. Berachain and Blast were confirmed by PeckShield as additional targets, though detailed, token-level figures for those two chains had not been published with the same granularity as Ethereum and Base. The $5.9 million total from QuillAudits incorporates those chains as well.

04Wasabi's Response and the Wider Fallout

On May 1, Wasabi published its first substantive update: the breach had been contained, the exposed access paths closed, and credentials and keys rotated. The team also sent an on-chain message to the address holding the stolen funds, expressing openness to a "constructive resolution" and asking the attacker to make contact privately.

The team confirmed its Solana deployments and Prop AMM were unaffected, and said a post-mortem was planned but not yet published. The attacker didn't wait for any of it and had already begun cashing out.

Elsewhere in the ecosystem, Berachain issued its own advisory, urging users to withdraw funds immediately and estimating that roughly $50,000 in user funds on its network were at risk; reward vault operations were temporarily paused as a precaution. Virtuals Protocol reiterated that it had frozen all Wasabi-linked margin deposits and that its own systems remained unaffected.

ZachXBT posed a pointed public question: "Why did a single EOA seemingly have so much control without basic safeguards? Seems your runway was burned on KOL grifters like Kook…."

Wasabi had raised $3 million from Electric Capital in 2024, with a co-investor list that included Pudgy Penguins CEO Luca Netz, Magic Eden co-founder Zhouxun Yin, and a roster of well-known crypto-Twitter personalities. Whether any of that funding went toward security infrastructure hasn't been addressed publicly.

Separately, a TRM Labs report published April 30 found that North Korea-linked state hackers were responsible for 76% of all global crypto-hacking losses in 2026 — nearly $600 million — pushing their cumulative total since 2017 past $6 billion. No formal link has been drawn between the Wasabi incident and North Korean actors, but the report underscores how active state-sponsored groups have been this year.

As of publication, the investigation remains open, no post-mortem has been released, and no compensation plan has been announced. Four of the five attacker wallets have moved funds through Tornado Cash; the fifth, holding 737.36 ETH, has not. Wasabi had a functioning product, real trading volume, and roughly $8.5 million in user deposits at stake — none of which mattered once control of the deployer key changed hands.

05The Underlying Problem Wasn't Technical

Wasabi's code was never broken — the attacker simply held the key, and the code did exactly what it had been built to do. That distinction matters: no audit would have caught this, no bug bounty would have flagged it, and no amount of smart-contract review changes the outcome when the most powerful role in a protocol rests behind a single private key with nothing standing between it and total control. The flaw wasn't in the contracts; it was in the decision to structure governance this way from the start.

The parallel to Drift Protocol's $285 million loss on April 1 is direct — a perpetuals protocol whose governance also lacked a timelock, drained within minutes by attackers who spent months building the access needed to reach it. The specific mechanism differed, but the failure mode was identical: one path to total control, no friction between gaining access and executing the theft, and no time for anyone to respond.

According to The Defiant, April 2026 closed out as DeFi's worst month on record, with $635 million lost across 28 incidents in 30 days — a count later revised to 29.

The frustrating part is that the standard defenses already exist and cost nothing to adopt. OpenZeppelin's TimelockController and Gnosis Safe are both free, open-source, and have been recommended practice in DeFi security circles for years. Neither was in place at Wasabi when it counted. None of the well-connected backers behind Wasabi's $3 million seed round appear to have made governance architecture a condition of their investment.

With four of five attacker wallets already cycled through Tornado Cash and one still holding funds, the investigation stays open and no compensation plan exists. Somewhere else in DeFi, another protocol is likely running the same setup right now — a single EOA holding ADMIN_ROLE, with no timelock, no multisig, and no governance layer standing between it and user deposits. Wasabi is unlikely to be the last project to find out what that costs.

Private Key LeakSingle Point of FailureWasabi Protocol
Investigation alerts

Get new scam files the moment we publish them — usually 2–3 emails a week.

Enter a valid email address.

No spam, unsubscribe anytime. We never sell your data. Crypto assets are volatile and high-risk; nothing here is financial advice.

You're on the list. Watch your inbox for the next scam file.