Crypto hacks continue as Wasabi Protocol drained for $4.5 million in admin key compromise
DeFi cant stop bleeding, and Wasabi Protocol is the latest to find out why. Wasabi Protocol, a perpetuals trading platform built on Ethereum and Base, was drained of approximately $4.55 million on Thursday after attackers compromised the protocols deployer key, security firm Blockaid said in an X post. The hack is the latest in a month that has produced over $605 million in DeFi losses across at least 12 incidents. The mechanic was an externally owned account, or EOA, called wasabideployer.eth held the sole ADMIN_ROLE in Wasabis permission system. An EOA is a wallet controlled by a private key, as opposed to a smart contract. Whoever holds the key controls the wallet. Once the attacker had access to the deployer key, they called grantRole on the permission contract to give themselves admin privileges with zero delay. Their helper contract then upgraded Wasabis perp vaults and LongPool to malicious implementations that drained the balances, Blockaid said. The exploit relied on UUPS upgradeability, a pattern where a smart contract can swap out its underlying code while keeping the same address. UUPS is widely used because it lets developers fix bugs without migrating users. It also means that if an attacker controls admin permissions, they can replace the contracts logic