The exploit used a similar playbook as Drift's $285 million breach earlier this month — a compromised deployer key with no timelock or multisig that resulted in a drain of funds.
What to know : Wasabi Protocol, a perpetuals trading platform on Ethereum and Base, was drained of about $4.55 million after attackers compromised its deployer admin key. The attacker used the compromised key to grant themselves admin privileges and UUPS-upgrade Wasabi’s vault contracts to malicious versions, draining assets from multiple pools on both chains. The incident, which lacked safeguards such as a timelock or multisig on the admin role, adds to more than $770 million in DeFi losses this year and echoes recent key-compromise exploits at Drift Protocol and Kelp DAO.
