← Wasabi Protocolreviewed 2026-11-01 · 14 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Wasabi Protocol against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #14[unverifiable][awaiting moderator]in section: Total Value Locked Collapse
“A DefiLlama snapshot referenced in search results showed TVL of roughly $584,000 as of around October 20, 2026, down about 13.6% over the trailing 30 days”
reviewerDefiLlama TVL about $584,000 as of around October 20, 2026, ATH $153.07M on Nov 11, 2024DefiLlama is a dynamic page and was not fetched in this review; the page itself flags the figure as low-confidence.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in section: April 2026 Multi-Chain Exploit
“Affected vaults on Ethereum included wWETH, sUSDC, wBITCOIN, wPEPE and the Long Pool”
reviewerAffected Ethereum vaults included wWETH, sUSDC, wBITCOIN, wPEPE and the Long PoolBroadly consistent, but the wBITCOIN vault name could not be found in the fetched source. - #4[partially supported][awaiting moderator]in section: April 2026 Multi-Chain Exploit
“Security firm Blockaid flagged the exploit in progress and urged holders of Wasabi LP tokens to revoke approvals to the vault contracts.”
reviewerBlockaid urged holders of Wasabi LP tokens to revoke approvals to the vault contractsBlockaid warning confirmed; the revoke-approvals detail is not in the cited article.
confirmed
11 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: April 2026 Multi-Chain Exploit
“the Ethereum-side drain executed at 07:49:47 UTC, with the Base drain following roughly three minutes later; the largest single transaction removed 840.9 WETH (about $1.9 million) from the wWETH vault”
reviewerEthereum drain executed at 07:49:47 UTC with Base roughly three minutes later; largest tx 840.9 WETH (~$1.9M) from wWETH vaultrekt.news matches exactly. - #2[confirmed][no action needed]in section: April 2026 Multi-Chain Exploit
“CoinDesk reported about $4.5 million, The Block and several other outlets reported 'more than $5 million,' and rekt.news put the figure at approximately $5.9 million.”
reviewerLoss figures vary: CoinDesk ~$4.5M, The Block >$5M, rekt.news ~$5.9MAll three figures match their sources. - #5[confirmed][no action needed]in section: April 2026 Multi-Chain Exploit
“Virtuals Protocol, whose AI trading agents routed margin deposits through Wasabi, froze those deposits as a precaution.”
reviewerVirtuals Protocol froze margin deposits routed through Wasabi as a precautionSupported. - #6[confirmed][no action needed]in section: Root Cause: Unprotected Admin Key
“Security firm Halborn concluded that the exploit was enabled by 'issues with private key security and the design of the platform's security protocols, not exploitable smart contract vulnerabilities.'”
reviewerHalborn concluded the exploit stemmed from private key security and design issues, not smart contract vulnerabilitiesMatches; Halborn does not mention AWS. - #7[confirmed][no action needed]in section: Root Cause: Unprotected Admin Key
“A single externally owned account, wasabideployer.eth, held the sole ADMIN_ROLE over every upgradeable vault within the protocol's PerpManager framework, with no multisig and no effective timelock (the framework supported a timelock, but it was set to a zero-second delay).”
reviewerSole ADMIN_ROLE on wasabideployer.eth, no multisig, timelock with zero delaySubstantively supported; rekt phrases it as 'no timelock existed' with delay=0, which the page reconciles. - #8[confirmed][no action needed]in section: Root Cause: Unprotected Admin Key
“One source, Phemex, reported a different account: that Wasabi disclosed attackers had exploited a vulnerability in its AWS cloud infrastructure to obtain the private keys, and put total losses at about $5.7 million ($4.8 million in user funds and $900,000 from the project treasury).”
reviewerPhemex reported AWS vulnerability and $5.7M loss ($4.8M user, $0.9M treasury); not corroborated elsewhereAccurately reported and appropriately hedged. - #9[confirmed][no action needed]in section: Fund Movement and Alleged Tornado Cash Links
“rekt.news reported that the attacker's wallet received 0.188 ETH at 01:12 UTC on April 30 from an address linked to Tornado Cash, which was used to fund gas for the attack”
reviewerAttacker wallet funded with 0.188 ETH from a Tornado Cash-linked address at 01:12 UTC; one wallet held 737.36 ETH as of May 4Supported. - #10[confirmed][no action needed]in section: Fund Movement and Alleged Tornado Cash Links
“The Block reported that firm BlockSec traced preliminary evidence that Tornado Cash-funded accounts were granted the admin-related roles used across the Long Pool, Short Pool and Vault contracts.”
reviewerBlockSec traced preliminary evidence of Tornado Cash-funded accounts granted admin roles across Long Pool, Short Pool, VaultSupported. - #11[confirmed][no action needed]in section: Fund Movement and Alleged Tornado Cash Links
“CoinDesk separately noted that the attack's mechanics closely resembled the April 1, 2026 Drift Protocol exploit, which outlets have linked to North Korea-affiliated actors, but did not state that the same actors were responsible for the Wasabi incident.”
reviewerCoinDesk noted resemblance to April 1, 2026 Drift exploit linked to North Korea, without attributing WasabiAccurately hedged. - #12[confirmed][no action needed]in section: Protocol Background and Original Product Claims
“Wasabi raised $3 million in a seed round led by Electric Capital”
reviewerThe Block 2024 seed round details ($3M, Electric Capital lead, 18,000 traders, $500M volume, $111M TVL, 66,000 LPs, leverage)Fully supported, including timeline[0] and timeline[1]. - #13[confirmed][no action needed]in section: Partial Recovery of Service and Compensation Status
“As of a May 9, 2026 update referenced in search aggregation, Wasabi had not announced a final user-compensation plan.”
reviewerWithdrawals reopened for unaffected vaults in early May 2026; no final compensation plan as of May 9Consistent with secondary sources; the page hedges appropriately.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.