Wasabi Protocol – multi-chain attack reveals critical weakness of DeFi | Bitcoin.pl

• Wasabi Protocol lost over $5 million due to admin key hijacking and contract manipulation.
• The attack affected several blockchains at the same time, and the funds were quickly transferred and dispersed.
• The problem was not due to a code error, but to an operational decision that allowed full control to a single key.

Wasabi Protocol was the victim of a coordinated attack in which the attacker used a compromised admin key to take control of the system and drain the associated liquidity pools. According to blockchain security companies, losses exceeded $5 million, and the operation simultaneously affected several networks, including Ethereum and layer two solutions.

The findings of Blockaid and CertiK show that the key element of the attack was access to the protocol’s implementation wallet. Thanks to this, the hacker obtained administrative privileges that allowed him to update contracts and change the system’s operating logic. This was enough.

In practice, this meant the ability to freely manage users’ assets deposited in the protocol. The attacker used this advantage to siphon funds from several infrastructure components, including LongPool, ShortPool, and vault contracts. Companies analyzing the incident indicated that there was no classic smart contract error. The code worked as intended. The problem was in the access management architecture.

The attack was not limited to one network. PeckShield reported that the attacker’s activities affected Ethereum, Base, Berachain and Blast. This scale suggests prior preparation and knowledge of the protocol infrastructure. Cyvers determined that the stolen assets included various tokens, including WETH and USDC. They were then consolidated into ETH, moved to the Ethereum mainnet, and distributed across multiple addresses.

The path of funds flow makes it difficult to recover them. BlockSec noted links to addresses financed by Tornado Cash. These accounts were supposed to have been granted administrative privileges before the actual attack, which indicates a preparatory stage.

A comment by Shalev Keren from Sodot sheds light on the cause of the incident. Wasabi used an access control mechanism that allows for a delay between granting permissions and their activation. This is standard security practice. In this case, the delay is set to zero. As a result, each change in permissions took effect immediately, without time for the monitoring systems or the team to react.

One decision was enough to create a single point of failure. This management model means that taking over one key gives you full control over the protocol – regardless of the number of supported networks and the value of funds.

No need to break contract security.

This is another case in which the access management infrastructure turned out to be the weakest link in the entire system.