Deployer admin key compromise enables multi-chain upgrade exploit, siphoning ~$5M from Wasabi perpetuals

Wasabi Protocol, a perpetuals trading platform, suffered a multi-chain exploit that drained between roughly $4.5 million and more than $5 million after an attacker seized an admin/deployer key, according to reporting by security firms and crypto outlets ^{[1] [2] [3]}.

Security firm Blockaid traced the breach to a deployer wallet that held the sole ADMIN_ROLE in Wasabi’s permission system; the attacker used the compromised admin key to upgrade vault contracts and withdraw funds from affected chains, including Ethereum and Base ^{[2] [1]}.

Observers and news outlets highlighted that the incident underscores the critical need for robust admin-key protections and secure governance controls in DeFi platforms, noting the attack moved funds across multiple chains ^{[4] [3]}.

Investigations and on-chain analysis are ongoing; reported loss estimates vary by outlet, but the exploit has renewed attention on permissioned-key risk and upgradeability controls in decentralized finance ^{[1] [2] [4]}.