Wasabi Protocol: One Key, No Multisig, $5.9M Gone in Three Minutes

At 07:49 UTC on 30 April 2026, eight vaults belonging to Wasabi Protocol were emptied in a single Ethereum transaction. Less than three minutes later the same thing happened on Base. Then Berachain and Blast. The thief never had to find a bug. They had the one key that every vault obeyed.

Wasabi later put the damage at about $5.7 million: roughly $4.8 million of its users' money and $900,000 from its own treasury. Investigators tracking the attacker's five wallets counted about $5.9 million. Users had about $8.5 million on deposit before the attack. Nearly six months on, no compensation plan has been announced.

What Wasabi was

Wasabi was a trading platform for perpetual futures, or "perps": bets on whether a coin will rise or fall that never expire, usually made with borrowed money, much like trading on margin at a broker. Its niche was leverage on "long tail" assets such as memecoins and NFTs. Co-founder Eren Derman told The Block in 2024 that its trades were fully backed by real assets. That year it raised $3 million in a seed round led by Electric Capital.

The money behind those trades sat in vaults: pooled deposits that lenders put in to earn interest from traders who borrowed. The vaults were smart contracts, programs that move money by themselves according to their rules. Wasabi ran them on four blockchains (Ethereum, Base, Berachain and Blast) plus a separate version on Solana.

One key, total control

Wasabi's vaults were upgradeable. In plain terms, the code that held the money could be swapped for new code at any time, a bit like a bank vault whose locks can be changed by phone. Many platforms do this so they can fix bugs. The danger lies in who is allowed to make the call.

At Wasabi it was one account, named wasabideployer.eth, which held the sole ADMIN_ROLE over every vault. It was an ordinary wallet controlled by a single private key, the secret password that signs transactions. Anyone holding that key could change any vault's code.

Two standard protections exist for exactly this. A multisig is a wallet that needs several people to sign, like a company account that needs two directors on every cheque. A timelock is a forced delay between announcing a change and carrying it out, so depositors can see trouble coming and withdraw. The security firm Blockaid said Wasabi had neither. The tools to add both, such as Safe (formerly Gnosis Safe) and OpenZeppelin's timelock contract, have been free and widely used for years.

Three minutes in April

The attack was prepared in the open. At 01:12 UTC on 30 April, the attacker's wallet received 0.188 ether from an address linked to Tornado Cash, a "mixer" that pools coins from many users to hide where they came from. More small top-ups followed. At 07:46 the attacker deployed their contracts.

Then they used the stolen key to give their own contract admin rights, with the delay set to zero. That contract "upgraded" Wasabi's vaults and its LongPool to new code whose only purpose was to send everything to the attacker. On Ethereum, 840.9 WETH (wrapped ether, about $1.9 million) left one vault alone. Base lost about $2.5 million. The LongPool on Ethereum went at 07:59.

Blockaid spotted the drain as it happened and posted a warning; CertiK, PeckShield and Hypernative followed. Wasabi's first word, more than two hours after Blockaid's alert according to Rekt News, was that it was "aware of an issue" and investigating. It told users to stop using its contracts and said it was working with SEAL 911, a volunteer crypto emergency team, with Blockaid and with law enforcement including the FBI. Virtuals Protocol, an AI-agent platform that used Wasabi for margin deposits, froze those deposits as a precaution, and Berachain paused reward vaults with about $50,000 at risk.

The stolen tokens, including USDC, PEPE, MOG, AERO and VIRTUAL, were swapped into ether and spread across five wallets. By early May four of the five had sent money through Tornado Cash. The fifth still held about 737 ETH on 4 May.

How the key got out

On 9 May Wasabi explained the break-in, and it had nothing to do with blockchains. A public-facing server the team used for analysis ran Spring Boot, a common business software framework. Its Actuator, a built-in diagnostics page, offered a "heap dump", a snapshot of the program's memory, without proper password protection. The attacker downloaded it, found credentials inside, used them to reach a second server on Wasabi's Amazon Web Services account, and from there took the private keys that controlled the smart contracts.

It was a server mistake of the most ordinary kind. Exposed Actuator endpoints are a well-known risk, and security firms have tracked scanners hunting for them across the internet. At most companies it would leak customer data. At Wasabi it leaked the master key to every vault.

Wasabi said only its EVM deployments, those on Ethereum and the chains built like it, were hit; Solana and its Prop AMM product were untouched. Unaffected vaults reopened for withdrawals on 2 May. It hired ZeroShadow, a fund-tracing firm, and said making users whole was its "top priority", but that no final decision on compensation had been made. In a post on X on 27 August it said a "material amount" of the stolen funds had been frozen, without giving a figure. No compensation plan had been published by mid-October 2026.

The month it happened in

CertiK counted about $651 million lost to crypto hacks and scams in April 2026, the most in a single month since March 2022 if February 2025, when Bybit alone lost $1.5 billion, is left aside. Drift Protocol, another perps platform, lost about $295 million on 1 April through hijacked admin signatures. Kelp DAO lost $292 million on 18 April. On the day of the Wasabi drain, TRM Labs reported that North Korean hackers had taken about $577 million in 2026, 76% of all hack losses. Nobody has publicly linked Wasabi to North Korea.

Wasabi's loss was small by that month's standards. Its cause was not. The code did exactly what it was written to do. It obeyed the one key, and the one key sat behind a diagnostics page anybody could read.