{"id":"wasabi-perps-deployer-key-theft-apr-2026","category":"breach","status":"closed","title":"Wasabi Protocol (Wasabi Perps) loses about US$5–6 million after admin key theft; no compensation plan published","tldr":"Wasabi Protocol's single admin key was compromised on 30 April 2026, letting an attacker upgrade its contracts on four blockchains and drain over US$5 million. No recovery or compensation plan has been found. Users should avoid Wasabi contracts and revoke approvals.","summary":"On 30 April 2026 an attacker took control of the deployer wallet key of Wasabi Protocol, a crypto trading platform for perpetual futures (Wasabi Perps). That one wallet was the only administrator of the protocol, with no multi-person approval and its safety delay set to zero. The attacker gave admin rights to their own contracts, swapped the code of Wasabi's vaults and pools on Ethereum, Base, Berachain and Blast, and drained them. Estimates of the loss range from about US$4.5 million to US$5.9 million; security firms said over US$5 million. Researchers describe a key-management failure, not a flaw in the contract code. The proceeds were converted to ETH and spread across several addresses, and one outlet reports some passed through Tornado Cash. Wasabi told users to avoid its contracts and said it was investigating. By 10 May it said a final compensation plan was still pending. We found no report of recovered funds, a full Wasabi post-mortem, a relaunch, arrests or charges as of 3 November 2026.","action":"If you have funds in Wasabi or hold Wasabi LP tokens, do not interact with its contracts, revoke any token approvals you gave it, and watch Wasabi's official channels for a compensation notice. Nothing else is needed otherwise.","product":"Wasabi Protocol (Wasabi Perps) crypto trading platform","audience":"home","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["crypto","defi","wasabi","key-compromise","admin-key","ethereum","base","theft"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"Wasabi Protocol hit by more than $5 million exploit across multiple chains, security firms say","url":"https://www.theblock.co/post/399558/wasabi-protocol-hit-by-more-than-5-million-exploit-across-multiple-chains-security-firms-say","by":"The Block","date":"2026-04-30"},{"kind":"research","title":"Explained: the Wasabi Protocol hack (April 2026)","url":"https://halborn.com/blog/post/explained-the-wasabi-protocol-hack-april-2026","by":"Halborn","date":"2026-05-04"},{"kind":"news","title":"Wasabi Protocol Says Final User Compensation Plan Still Pending After Security Incident","url":"https://coincu.com/wasabi-protocol-final-user-compensation-plan-pending-security-incident/","by":"Coincu","date":"2026-05-10"},{"kind":"news","title":"Wasabi Protocol - Rekt","url":"https://rekt.news/wasabi-protocol-rekt","by":"Rekt News","date":"2026-05-01"}],"started":"2026-04-30","closed":"2026-05-10","created":"2026-11-03T22:05:26.260Z","updated":"2026-11-03T22:05:26.260Z","cve_notes":[],"timeline":[{"at":"2026-05-10","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Wasabi said its final user compensation plan was still pending, with no timeline, eligibility rules or payout structure announced, and that internal assessments were still under way.","url":"https://coincu.com/wasabi-protocol-final-user-compensation-plan-pending-security-incident/","by":"Coincu","patch":null},{"at":"2026-05-04","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Halborn's analysis said the attacker used the key of wasabideployer.eth, the sole administrator account with no multisig and a timelock set to zero, to grant admin rights to a malicious contract. That contract upgraded vaults and pools, and the proceeds were converted to ETH and moved to other addresses.","url":"https://halborn.com/blog/post/explained-the-wasabi-protocol-hack-april-2026","by":"Halborn","patch":null},{"at":"2026-04-30","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"Security firms reported that the Wasabi Protocol's deployer wallet key was compromised and used to upgrade contracts on Ethereum, Base, Berachain and Blast. They put losses at over US$5 million. Wasabi told users to avoid its contracts while it investigated, and Virtuals Protocol froze margin deposits powered by Wasabi.","url":"https://www.theblock.co/post/399558/wasabi-protocol-hit-by-more-than-5-million-exploit-across-multiple-chains-security-firms-say","by":"The Block","patch":"na"}],"url":"https://hard.fyi/live/wasabi-perps-deployer-key-theft-apr-2026/","json":"https://hard.fyi/api/live?id=wasabi-perps-deployer-key-theft-apr-2026"}