Wasabi Protocol, a DeFi platform for leveraged memecoin trading, was hit by an exploit that Blockaid says had already extracted $4.5 million.
Wasabi Protocol, a DeFi protocol built for leveraged bets on memecoins, NFTs and other long-tail tokens was hit by an admin-key exploit that drained over $4.5 million across Ethereum and Base.
Blockchain security firm Blockaid alarmed in an X post on Thursday, April 30, that its exploit detection system flagged an ongoing compromise at the protocol.
- Early details suggest the project’s deployer wallet was used to give admin access to a contract controlled by the attacker.
- That attacker-controlled contract then changed Wasabi’s perp vaults and LongPool to malicious versions, which allowed the funds to be drained.
Blockchain security firm PeckShield noted in a separate X post that the stolen amount might be bigger as the protocol was hacked not only on Ethereum and Base, but also on Berachain and Blast.
Read also: FBI Arrests 276 Crypto Fraudsters in Global Operation
Contents
The Weak Point
The root cause, according to Blockaid, was the compromise of a single externally owned admin wallet with no multisig or timelocks that would slow down significant changes.
- Blockaid says the attacker used the grantRole function to make its orchestrator an admin with zero delay, then bypassed the onlyAdmin check tied to Wasabi Protocol’s vault deposits.
The blockchain security firm listed several compromised vaults on Ethereum, including pools tied to wWETH, sUSDC, sREKT and wPEPE. On Base, the affected vaults included sUSDC, wWETH and sBTC/cbBTC, among others.
Visible Risk
Wasabi Protocol is the largest derivatives trading protocol on Blast, a Layer-2 network launched by Blur founder Tieshun Roquerre, who is better known in crypto as Pacman.
As of press time, DefiLlama data shows Wasabi Protocol has about $8.5 million in total value locked across five chains, with Base accounting for the biggest share at around $4.1 million.
In 2024, Wasabi Protocol raised $3 million in seed funding led by Electric Capital, with backers including Alliance, Memeland, Spencer Ventures, Pudgy Penguins CEO Luca Netz, Magic Eden co-founder Zhouxun Yin and others.
Read more: Billions at Risk on LayerZero as KelpDAO Hack Exposes Weak Setting: CoinGecko
