Overview
- Blockchain security firms reported more than $5 million stolen from Wasabi across Ethereum, Base, Berachain, and Blast in a month when DeFi hacks topped $600 million including the $292 million Kelp DAO theft.
- Investigators said the thief used a privileged key on the Wasabi deployer wallet to push contract upgrades that allowed withdrawals from vaults.
- Cyvers said the attacker took tokens such as WETH, USDC, PEPE, MOG, and others, then converted most of the haul into ETH and bridged the funds to Ethereum.
- Wasabi told users to stop interacting with its contracts while it investigates, and Virtuals Protocol froze Wasabi-powered margin deposits as a precaution.
- Blockaid warned that LP-share tokens issued by the affected vaults should be treated as compromised, since these receipts represent claims on pools that were altered by the attacker.