{"id":96691,"date":"2026-04-30T14:20:22","date_gmt":"2026-04-30T11:20:22","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=96691"},"modified":"2026-04-30T14:25:19","modified_gmt":"2026-04-30T11:25:19","slug":"hacker-extracts-over-5-million-from-wasabi-protocol","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/hacker-extracts-over-5-million-from-wasabi-protocol\/","title":{"rendered":"Hacker Extracts Over $5 Million from Wasabi Protocol"},"content":{"rendered":"<p>On April 30th, the Wasabi project was hacked. According to PeckShield experts, the damage exceeded $5 million.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/PeckShieldAlert?src=hash&#038;ref_src=twsrc%5Etfw\">#PeckShieldAlert<\/a> <a href=\"https:\/\/twitter.com\/wasabi_protocol?ref_src=twsrc%5Etfw\">@wasabi_protocol<\/a> has been exploited for $5M+ across multiple chains, including Ethereum, Base, Berachain, &#038; Blast. <a href=\"https:\/\/t.co\/zkWjEkZMMp\">pic.twitter.com\/zkWjEkZMMp<\/a><\/p>\n<p>\u2014 PeckShieldAlert (@PeckShieldAlert) <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/2049787810237067382?ref_src=twsrc%5Etfw\">April 30, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Experts from CertiK estimated the losses at $5.5 million. The attack affected funds across several networks: Ethereum, <a href=\"https:\/\/forklog.com\/en\/news\/what-is-base-coinbases-l2\">Base<\/a>, Berachain, and Blast.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">UPDATE:<\/p>\n<p>Total losses amount to ~$5.5M across the ETH, BASE, BLAST, and BERA chains:<a href=\"https:\/\/t.co\/c37s3gNtwB\">https:\/\/t.co\/c37s3gNtwB<\/a><a href=\"https:\/\/t.co\/Sj9gtovG5K\">https:\/\/t.co\/Sj9gtovG5K<\/a><a href=\"https:\/\/t.co\/E5W6LLDuen\">https:\/\/t.co\/E5W6LLDuen<\/a><a href=\"https:\/\/t.co\/fUZrwM5NmK\">https:\/\/t.co\/fUZrwM5NmK<\/a><\/p>\n<p>\u2014 CertiK Alert (@CertiKAlert) <a href=\"https:\/\/twitter.com\/CertiKAlert\/status\/2049776607422722490?ref_src=twsrc%5Etfw\">April 30, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>According to <a href=\"https:\/\/x.com\/blockaid_\/status\/2049768426181104095\">Blockaid<\/a>, the attacker gained access to an administrative key and through a special Wasabi wallet, appointed their version of the contract as the manager. Using <span data-descr=\"a technology that allows updating a smart contract without changing its address on the blockchain\" class=\"old_tooltip\">UUPS upgrade<\/span>, they altered the internal logic of the platform&#8217;s storage and extracted the assets.\u00a0<\/p>\n<p>The founder of SlowMist, under the pseudonym Cos, <a href=\"https:\/\/x.com\/evilcos\/status\/2049787515234857176\">highlighted<\/a> the protocol&#8217;s weak security mechanisms. According to him, storage management was conducted by a single <span data-descr=\"externally owned account\" class=\"old_tooltip\">EOA<\/span> without <a href=\"https:\/\/forklog.com\/en\/news\/what-is-a-multisignature-what-is-a-ring-signature\">multisig<\/a>, time lock, or <a href=\"https:\/\/forklog.com\/en\/news\/what-is-a-dao-decentralised-autonomous-organisation\">DAO<\/a>. This allowed the hacker to compromise the private key easily, raising questions within the community.<\/p>\n<blockquote class=\"twitter-tweet\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">Why did a single EOA seemingly have so much control without basic safeguards?<\/p>\n<p>Seems your runway was burned on KOL grifters like Kook\u2026. <a href=\"https:\/\/t.co\/sRNtM8Ai8K\">https:\/\/t.co\/sRNtM8Ai8K<\/a> <a href=\"https:\/\/t.co\/rXzCSZpCD0\">pic.twitter.com\/rXzCSZpCD0<\/a><\/p>\n<p>\u2014 ZachXBT (@zachxbt) <a href=\"https:\/\/twitter.com\/zachxbt\/status\/2049801251811152168?ref_src=twsrc%5Etfw\">April 30, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>BlockSec <a href=\"https:\/\/x.com\/Phalcon_xyz\/status\/2049772035736539516\">added<\/a> that administrative roles were assigned to wallets funded through the crypto mixer <a href=\"https:\/\/forklog.com\/en\/news\/what-is-the-tornado-cash-mixer-and-why-was-it-sanctioned\">Tornado Cash<\/a>.\u00a0<\/p>\n<p>According to Cyvers, the cybercriminal stole WETH, PEPE, MOG, USDC, ZYN, REKT, cbBTC, AERO, VIRTUAL and has already converted the assets into ETH, distributing them across multiple addresses.\u00a0<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">\ud83d\udea8ALERT\ud83d\udea8Our system has detected multiple suspicious transactions involving <a href=\"https:\/\/twitter.com\/wasabi_protocol?ref_src=twsrc%5Etfw\">@wasabi_protocol<\/a> <\/p>\n<p>An address funded via <a href=\"https:\/\/twitter.com\/TornadoCash?ref_src=twsrc%5Etfw\">@TornadoCash<\/a> deployed a malicious contract on both <a href=\"https:\/\/twitter.com\/hashtag\/Base?src=hash&#038;ref_src=twsrc%5Etfw\">#Base<\/a> and <a href=\"https:\/\/twitter.com\/hashtag\/Ethereum?src=hash&#038;ref_src=twsrc%5Etfw\">#Ethereum<\/a>, extracting approximately $4.5M across multiple assets, including <a href=\"https:\/\/twitter.com\/search?q=%24WETH&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$WETH<\/a>, <a href=\"https:\/\/twitter.com\/search?q=%24PEPE&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$PEPE<\/a>, <a href=\"https:\/\/twitter.com\/search?q=%24MOG&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$MOG<\/a>, <a href=\"https:\/\/twitter.com\/search?q=%24USDC&#038;src=ctag&#038;ref_src=twsrc%5Etfw\">$USDC<\/a>,\u2026 <a href=\"https:\/\/t.co\/UHTRNvqZ15\">pic.twitter.com\/UHTRNvqZ15<\/a><\/p>\n<p>\u2014 \ud83d\udea8 Cyvers Alerts \ud83d\udea8 (@CyversAlerts) <a href=\"https:\/\/twitter.com\/CyversAlerts\/status\/2049770383528624267?ref_src=twsrc%5Etfw\">April 30, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The Wasabi team <a href=\"https:\/\/x.com\/wasabi_protocol\/status\/2049799232865874155\">confirmed<\/a> the hack and advised users not to interact with the protocol&#8217;s contracts until further notice.\u00a0<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>\u201cWe will provide updated information as soon as new data becomes available,\u201d the developers noted.\u00a0<\/em><\/p>\n<\/blockquote>\n<p>Earlier, on April 28th, the Ethereum infrastructure project Syndicate was also hacked. Cybersecurity experts estimated the losses at $330,000.\u00a0<\/p>\n<p>At the same time, attackers breached the Aftermath Finance exchange in the Sui ecosystem, extracting about $900,000 in USDC.<\/p>\n<p>The day before, the L1 network ZetaChain was affected. Developers stated that the incident only impacted the team&#8217;s internal wallets, with damages amounting to $333,868.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>On April 30th, the Wasabi project was hacked. According to PeckShield experts, the damage exceeded $5 million.<\/p>\n","protected":false},"author":1,"featured_media":96692,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Wasabi project hacked on April 30th, with losses exceeding $5 million.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[44,1093],"class_list":["post-96691","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-cybercrime","tag-defi"],"aioseo_notices":[],"amp_enabled":true,"views":"14","promo_type":"1","layout_type":"1","short_excerpt":"Wasabi project hacked on April 30th, with losses exceeding $5 million.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=96691"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96691\/revisions"}],"predecessor-version":[{"id":96693,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96691\/revisions\/96693"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/96692"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=96691"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=96691"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=96691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}