Wasabi Hack: $5M Stolen, Damage on BLAST Network
Contents
DeFi derivatives platform Wasabi Protocol was hit by a cross-chain attack, and hackers stole assets worth more than 5 million dollars. PeckShield confirmed that the incident spread across Ethereum, Base, Berachain, and BLAST detailed analysis networks. According to Blockaid and CertiK, the attacker infiltrated Wasabi's deployer wallet with a compromised admin key, upgraded core systems, and drained the funds. As a result, liquidity pools from LongPool, ShortPool, and Vault contracts were targeted. The attacker's Tornado Cash-linked accounts gained access to admin roles.
Technical Details of the Wasabi Attack
The attacker seized the admin key to take control of the deployer wallet. By 'upgrading' the contracts, they added a backdoor and instantly drained the liquidity. Transfers to Ethereum via cross-chain bridges made tracking difficult. This demonstrates the misuse of smart contract authorities (delegatecall) – a critical warning for protocol developers.
Impacts and Risks on the BLAST Network
On BLAST layer-2, LP tokens were affected; Blockaid reported that all Wasabi/Spicy LP tokens are at risk. Underlying assets were drained, and the remaining ones are still dangerous. BLAST futures investors should be cautious against volatility. Virtuals Protocol took precautions by freezing margin deposits and stated that its own system is secure.
Stolen Assets and Hacker Movements
| Asset | Amount (Estimated) | Target |
|---|---|---|
| WETH | High | Converted to ETH |
| PEPE | Medium | Bridged |
| MOG | Medium | Distributed |
| USDC | Low | ETH Bridge |
| ZYN, REKT, cbBTC, AERO, VIRTUAL | Various | Tornado Cash |
According to the Cyvers report, the hacker converted the assets to ETH and spread them across Ethereum addresses. Total loss 5M$+.
PeckShield, CertiK, and BlockSec Reports
- PeckShield: Cross-chain spread confirmed, LP drainage on Blast.
- Blockaid: LP tokens 'high risk', avoid interaction.
- CertiK: Admin key compromise, upgrade exploit.
- BlockSec & Cyvers: Tracked fund flows, Tornado connection.
The Wasabi team launched an investigation on X and imposed an interaction ban.
Lessons from BLAST and Similar Incidents in DeFi
This hack reflects DeFi's dark period, crowned by Kelp DAO's 292M$ loss (total 600M$+ losses). AI-supported attacks are increasing; protocols should add layers like multisig, time-lock, and RLN (rate-limited nonce). For BLAST investors: high correlation with ETH detailed analysis, monitor liquidity risks. The sector is turning to urgent audits and upgrade protocols.