{"investigation":{"slug":"wasabi-protocol","entity_name":"Wasabi Protocol","trust_score":53,"severity_base":59,"score_modifier":-5.9,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Wasabi Protocol is a decentralized leverage-trading platform for memecoins, NFTs and other 'long-tail' assets, launched on Ethereum and Blast and later expanded to Base, Berachain and Solana. On April 30, 2026, an attacker who had obtained the private key of the protocol's sole administrative wallet drained an estimated $4.5 million to $5.9 million across Ethereum, Base, Berachain and Blast vaults; security researchers attributed the loss to the absence of a multisig or timelock on that admin key rather than to a smart-contract bug. Total value locked collapsed afterward, and as of late October 2026 stood at a small fraction of its November 2024 peak.","sections":[{"content":"On April 30, 2026, Wasabi Protocol was drained of funds across vaults on Ethereum, Base, Berachain and Blast. According to rekt.news, the Ethereum-side drain executed at 07:49:47 UTC, with the Base drain following roughly three minutes later; the largest single transaction removed 840.9 WETH (about $1.9 million) from the wWETH vault. Reported total losses vary by outlet and by the time the figure was compiled: CoinDesk reported about $4.5 million, The Block and several other outlets reported 'more than $5 million,' and rekt.news put the figure at approximately $5.9 million. Affected vaults on Ethereum included wWETH, sUSDC, wBITCOIN, wPEPE and the Long Pool; affected vaults on Base included sUSDC, wWETH, sBTC, sVIRTUAL, sAERO and sBRETT. Security firm Blockaid flagged the exploit in progress and urged holders of Wasabi LP tokens to revoke approvals to the vault contracts. Virtuals Protocol, whose AI trading agents routed margin deposits through Wasabi, froze those deposits as a precaution. As of the reporting reviewed, Wasabi had not issued a detailed public post-mortem beyond operational updates.","heading":"April 2026 Multi-Chain Exploit","sources":[{"url":"https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise","name":"CoinDesk: Wasabi Protocol drained for $4.5 million in apparent admin key compromise","type":"news_article","credibility":1},{"url":"https://www.theblock.co/news/defi/2026-04-30-wasabi-protocol-hit-by-more-than-5-million-exploit-across-multiple-chains-security-firms-say-399558","name":"The Block: Wasabi Protocol hit by more than $5 million exploit across multiple chains, security firms say","type":"news_article","credibility":1},{"url":"https://alpha.rekt.news/wasabi-protocol-rekt","name":"rekt.news: Wasabi Protocol","type":"research","credibility":2}],"severity":"critical"},{"content":"Security firm Halborn concluded that the exploit was enabled by 'issues with private key security and the design of the platform's security protocols, not exploitable smart contract vulnerabilities.' A single externally owned account, wasabideployer.eth, held the sole ADMIN_ROLE over every upgradeable vault within the protocol's PerpManager framework, with no multisig and no effective timelock (the framework supported a timelock, but it was set to a zero-second delay). rekt.news reported that once the attacker controlled that key, they called grantRole() to hand admin rights to an orchestrator contract, which then upgraded the vault and Long Pool contracts via UUPS proxy upgrades to malicious implementations while preserving the original contract addresses. A fake strategy contract accepted deposits through strategyDeposit() to an arbitrary destination and then swept the funds to the attacker. How the private key itself was obtained was not established in any source reviewed; rekt.news listed phishing, malware, social engineering and insider access as unconfirmed possibilities. One source, Phemex, reported a different account: that Wasabi disclosed attackers had exploited a vulnerability in its AWS cloud infrastructure to obtain the private keys, and put total losses at about $5.7 million ($4.8 million in user funds and $900,000 from the project treasury). This AWS-based explanation was not corroborated by CoinDesk, The Block, Halborn or rekt.news, all of which describe the root cause solely as a compromised/unprotected admin key without mentioning AWS, so the AWS claim should be treated as unverified pending a formal Wasabi post-mortem.","heading":"Root Cause: Unprotected Admin Key","sources":[{"url":"https://halborn.com/blog/post/explained-the-wasabi-protocol-hack-april-2026","name":"Halborn: Explained: The Wasabi Protocol Hack (April 2026)","type":"research","credibility":2},{"url":"https://alpha.rekt.news/wasabi-protocol-rekt","name":"rekt.news: Wasabi Protocol","type":"research","credibility":2},{"url":"https://phemex.com/news/article/wasabi-protocol-suffers-57-million-theft-due-to-aws-vulnerability-80096","name":"Phemex: Wasabi Protocol Suffers $5.7 Million Theft Due to AWS Vulnerability","type":"news_article","credibility":3}],"severity":"high"},{"content":"On-chain analysts reported that the stolen assets were converted to ETH and split across roughly five attacker-controlled wallets. rekt.news reported that the attacker's wallet received 0.188 ETH at 01:12 UTC on April 30 from an address linked to Tornado Cash, which was used to fund gas for the attack, and that four of the five wallets holding stolen funds subsequently sent assets through Tornado Cash; one wallet held 737.36 ETH as unmoved funds as of May 4, 2026. On-chain analytics firm Specter was reported to have tracked roughly $5.9 million in stolen funds being deposited into Tornado Cash, while analytics firm Cyvers described the attacker consolidating funds into ETH and bridging them to Ethereum before distributing them across multiple addresses. The Block reported that firm BlockSec traced preliminary evidence that Tornado Cash-funded accounts were granted the admin-related roles used across the Long Pool, Short Pool and Vault contracts. No individual or group has been formally attributed to the attack in any source reviewed; rekt.news noted only that the attacker's contract bytecode showed similarities to patterns seen in prior activity and that TRM Labs has separately reported on North Korea-linked hacking operations, without linking that reporting to the Wasabi incident specifically. CoinDesk separately noted that the attack's mechanics closely resembled the April 1, 2026 Drift Protocol exploit, which outlets have linked to North Korea-affiliated actors, but did not state that the same actors were responsible for the Wasabi incident.","heading":"Fund Movement and Alleged Tornado Cash Links","sources":[{"url":"https://alpha.rekt.news/wasabi-protocol-rekt","name":"rekt.news: Wasabi Protocol","type":"research","credibility":2},{"url":"https://www.theblock.co/news/defi/2026-04-30-wasabi-protocol-hit-by-more-than-5-million-exploit-across-multiple-chains-security-firms-say-399558","name":"The Block: Wasabi Protocol hit by more than $5 million exploit across multiple chains, security firms say","type":"news_article","credibility":1}],"severity":"medium"},{"content":"Secondary reporting (aggregated by threatcluster.io and corroborated in part by Phemex) indicates that Wasabi resumed withdrawals from unaffected vaults in early May 2026: one summary states withdrawals for unaffected vaults reopened on May 2, 2026, and a team update on or around May 3, 2026 stated that funds in unaffected EVM vaults had been restored for normal withdrawals, while vaults directly compromised in the attack (including sWETH, sUSDC and sPEPE) remained blocked. Phemex reported that Wasabi said 'the vulnerability has been contained' and that the protocol had engaged blockchain-forensics firm ZeroShadow to track the stolen funds. As of a May 9, 2026 update referenced in search aggregation, Wasabi had not announced a final user-compensation plan. These details rely on secondary/aggregator coverage rather than an archived primary statement from Wasabi's own channels, so they should be treated as moderately, not fully, confirmed.","heading":"Partial Recovery of Service and Compensation Status","sources":[{"url":"https://threatcluster.io/cluster/wasabi-protocol-users-can-withdraw-funds-after-security-inci-eeb08e56","name":"threatcluster.io: Wasabi Protocol users can withdraw funds after security incident","type":"other","credibility":3},{"url":"https://phemex.com/news/article/wasabi-protocol-suffers-57-million-theft-due-to-aws-vulnerability-80096","name":"Phemex: Wasabi Protocol Suffers $5.7 Million Theft Due to AWS Vulnerability","type":"news_article","credibility":3}],"severity":"medium"},{"content":"DefiLlama's listing for 'Wasabi Perps' recorded an all-time-high TVL of about $153.07 million on November 11, 2024. A DefiLlama snapshot referenced in search results showed TVL of roughly $584,000 as of around October 20, 2026, down about 13.6% over the trailing 30 days, which would represent a decline of more than 99% from the 2024 peak. A separate DefiLlama entry recorded TVL of about $1.12 million at the time of the April 30, 2026 hack. These figures were obtained via search-result snippets rather than a direct, successful fetch of the DefiLlama page (the page returned an access error when fetched directly), so the exact current figure could not be independently confirmed at the time of this report and should be treated as low-confidence pending direct verification.","heading":"Total Value Locked Collapse","sources":[{"url":"https://defillama.com/protocol/wasabi-perps","name":"DefiLlama: Wasabi Perps protocol page","type":"on_chain","credibility":2}],"severity":"medium"},{"content":"Wasabi Protocol is a DeFi platform offering leveraged long/short trading on 'long-tail' assets such as memecoins and NFTs, along with yield vaults. According to The Block's June 17, 2024 report, Wasabi raised $3 million in a seed round led by Electric Capital, with participation from Alliance, Memeland, Spencer Ventures, Pudgy Penguins CEO Luca Netz and Magic Eden co-founder Zhouxun Yin, among others; the round opened in early January 2024 and closed at the end of February 2024. Co-founder Eren Derman told The Block that, as of that date, Wasabi had more than 18,000 traders who had generated over $500 million in trading volume since January 2024, with total value locked above $111 million and more than 66,000 liquidity providers. Derman said leverage on exotic, lower-liquidity assets ran at 2-3x, while flagship assets such as ETH and USDB offered up to 10x leverage, and described Wasabi's perpetuals as fully asset-backed, which he said removed counterparty risk compared to synthetic perpetual-swap exchanges. These figures and characterizations are the company's own claims as relayed by Derman to a reporter and have not been independently audited in the sources reviewed for this report. The protocol was originally deployed on Ethereum and Blast and has since been listed as supporting Base as well.","heading":"Protocol Background and Original Product Claims","sources":[{"url":"https://www.theblock.co/news/deals/2024-06-17-memecoin-leverage-trading-protocol-wasabi-funding-300465","name":"The Block: Memecoin leverage trading protocol Wasabi raises funding","type":"news_article","credibility":1}],"severity":"low"}],"timeline":[{"date":"2024-01","event":"Wasabi's seed funding round begins raising, according to co-founder Eren Derman.","source":"The Block","source_url":"https://www.theblock.co/news/deals/2024-06-17-memecoin-leverage-trading-protocol-wasabi-funding-300465"},{"date":"2024-06-17","event":"The Block reports Wasabi raised $3 million in a seed round led by Electric Capital, with more than 18,000 traders, $500M+ in trading volume and $111M+ TVL at the time.","source":"The Block","source_url":"https://www.theblock.co/news/deals/2024-06-17-memecoin-leverage-trading-protocol-wasabi-funding-300465","date_evidence":"The article is dated June 17, 2024"},{"date":"2024-11-11","event":"Wasabi Perps reaches its all-time-high recorded TVL of approximately $153.07 million, per DefiLlama.","source":"DefiLlama","source_url":"https://defillama.com/protocol/wasabi-perps","date_evidence":"All-time high TVL: $153.07m on Nov 11, 2024"},{"date":"2026-04","event":"An attacker who compromised Wasabi's sole admin key drains vaults across Ethereum, Base, Berachain and Blast, with losses reported between approximately $4.5 million and $5.9 million depending on source.","source":"rekt.news / CoinDesk / The Block","source_url":"https://alpha.rekt.news/wasabi-protocol-rekt","date_evidence":"the Ethereum vault drain executed at 07:49:47 UTC, and the Base drain followed about three minutes later","date_original":"2026-04-30"},{"date":"2026-05","event":"Wasabi reportedly resumes withdrawals for unaffected vaults while vaults directly hit in the exploit (e.g., sWETH, sUSDC, sPEPE) remain blocked; the protocol reportedly engages ZeroShadow to trace stolen funds.","source":"threatcluster.io aggregation / Phemex","source_url":"https://phemex.com/news/article/wasabi-protocol-suffers-57-million-theft-due-to-aws-vulnerability-80096"},{"date":"2026-10","event":"DefiLlama search snapshot shows Wasabi Perps TVL at roughly $584,000, down more than 99% from its November 2024 peak.","source":"DefiLlama","source_url":"https://defillama.com/protocol/wasabi-perps"}],"sources_used":[{"url":"https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise","name":"CoinDesk: Wasabi Protocol drained for $4.5 million in apparent admin key compromise","type":"news_article","archive_url":"http://web.archive.org/web/20261003220840/https://www.coindesk.com/tech/2026/04/30/wasabi-protocol-drained-for-usd4-5-million-in-apparent-admin-key-compromise","credibility":1,"archive_timestamp":"2026-10-03T22:08:40+00:00"},{"url":"https://www.theblock.co/news/defi/2026-04-30-wasabi-protocol-hit-by-more-than-5-million-exploit-across-multiple-chains-security-firms-say-399558","name":"The Block: Wasabi Protocol hit by more than $5 million exploit across multiple chains, security firms say","type":"news_article","archive_url":"http://web.archive.org/web/20261010155743/https://www.theblock.co/news/defi/2026-04-30-wasabi-protocol-hit-by-more-than-5-million-exploit-across-multiple-chains-security-firms-say-399558","credibility":1,"archive_timestamp":"2026-10-10T15:57:43+00:00"},{"url":"https://www.theblock.co/news/deals/2024-06-17-memecoin-leverage-trading-protocol-wasabi-funding-300465","name":"The Block: Memecoin leverage trading protocol Wasabi raises funding","type":"news_article","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://halborn.com/blog/post/explained-the-wasabi-protocol-hack-april-2026","name":"Halborn: Explained: The Wasabi Protocol Hack (April 2026)","type":"research","archive_url":"http://web.archive.org/web/20261004060425/https://www.halborn.com/blog/post/explained-the-wasabi-protocol-hack-april-2026","credibility":2,"archive_timestamp":"2026-10-04T06:04:25+00:00"},{"url":"https://alpha.rekt.news/wasabi-protocol-rekt","name":"rekt.news: Wasabi Protocol","type":"research","archive_url":"http://web.archive.org/web/20261030212210/https://alpha.rekt.news/wasabi-protocol-rekt","credibility":2,"archive_timestamp":"2026-10-30T21:22:10+00:00"},{"url":"https://phemex.com/news/article/wasabi-protocol-suffers-57-million-theft-due-to-aws-vulnerability-80096","name":"Phemex: Wasabi Protocol Suffers $5.7 Million Theft Due to AWS Vulnerability","type":"news_article","archive_url":"http://web.archive.org/web/20261030214426/https://phemex.com/news/article/wasabi-protocol-suffers-57-million-theft-due-to-aws-vulnerability-80096","credibility":3,"archive_timestamp":"2026-10-30T21:44:26+00:00"},{"url":"https://threatcluster.io/cluster/wasabi-protocol-users-can-withdraw-funds-after-security-inci-eeb08e56","name":"threatcluster.io: Wasabi Protocol users can withdraw funds after security incident","type":"other","archive_url":"http://web.archive.org/web/20260517053233/https://threatcluster.io/cluster/wasabi-protocol-users-can-withdraw-funds-after-security-inci-eeb08e56","credibility":3,"archive_timestamp":"2026-05-17T05:32:33+00:00"},{"url":"https://defillama.com/protocol/wasabi-perps","name":"DefiLlama: Wasabi Perps protocol page","type":"on_chain","archive_url":"http://web.archive.org/web/20261008192056/https://defillama.com/protocol/wasabi-perps","credibility":2,"archive_timestamp":"2026-10-08T19:20:56+00:00"}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-05-28T03:33:12.495727+00:00","updated_at":"2026-11-02T00:49:06.686194+00:00"},"source_quality":{"total":8,"tier1":0,"tier2":4,"tier3":0,"unrated":4},"follower_count":null,"content_updated_at":"2026-11-01T21:51:36.325Z","last_fact_checked_at":"2026-11-01T21:51:34.687Z","fact_check_next_allowed_at":"2026-11-08T21:51:34.687Z","update_next_allowed_at":"2026-11-08T20:19:10.342Z"}