Wasabi Protocol $5.7M Loss Due to AWS Infrastructure Vulnerability

Incident Overview

On April 30, 2026, Wasabi Protocol suffered a major security incident. The project is a perpetuals trading platform built on Ethereum and Base. The attacker exploited a Spring Boot Actuator heap dump vulnerability exposed on Wasabi’s AWS infrastructure. This allowed them to obtain sensitive credentials and private keys, ultimately leading to the theft of approximately $5.7M ($4.8M in user funds + $0.9M from the protocol treasury).

Background

Wasabi Protocol focuses on leveraged perpetuals for meme coins and long‑tail assets, allowing traders to hold positions with no expiry date. The platform is deployed across multiple EVM chains (Ethereum, Base, Blast, Berachain).

Spring Boot Actuator is a monitoring and management tool for the Spring Boot framework, providing endpoints such as /heapdump to inspect application memory state. If security measures are not properly configured (e.g., authentication, access restrictions), these endpoints can become severe information disclosure vulnerabilities.

Exploit Breakdown

The attacker discovered an unprotected Spring Boot Actuator /heapdump endpoint on Wasabi’s AWS servers, successfully downloaded a memory snapshot, and extracted sensitive credentials — ultimately obtaining the private key for the core deployer wallet wasabideployer.eth. After acquiring the private key, the attack unfolded as follows:

1. Using wasabideployer.eth (which held the sole ADMIN_ROLE), the attacker called grantRole() to assign ADMIN_ROLE to a malicious contract they deployed, setting executionDelay to 0 (no delay).
2. With the malicious contract as admin, multiple WasabiVaults were upgraded via UUPS proxy upgrade to malicious implementations.
3. The malicious contract invoked legitimate functions such as strategyDeposit() to drain funds to attacker‑controlled addresses.
4. Several LongPools were similarly upgraded and emptied. The entire attack was completed in a short period across Ethereum, Base, Blast, and Berachain. The Solana deployment and Prop AMM were unaffected.

Why It Happened?

The root cause of this incident was twofold. Off‑chain, the Spring Boot Actuator was misconfigured, leaving the /heapdump endpoint publicly accessible. This exposed sensitive credentials and the deployer’s private key. On‑chain, wasabideployer.eth was a single EOA holding the ADMIN_ROLE for all upgradeable Vaults, without any multisig or timelock protections.

Once the private key was compromised, complete control of the protocol was lost. This incident underscores, once again, that off‑chain security and on‑chain permission design are equally critical in DeFi projects.

Aftermath and Response

The attacker stole approximately $5.7M in assets, including WETH, USDC, and various meme coins such as PEPE and MOG. The stolen funds were quickly converted to ETH and dispersed across multiple addresses. Losses amounted to about $4.8M in user funds and $0.9M from the protocol treasury.

The incident had wider effects on the ecosystem: Virtuals Protocol, which relied on Wasabi’s margin mechanism, froze related deposits; prices of several Wasabi LP tokens fell sharply; and the DeFi community renewed its focus on admin key security and infrastructure configuration risks.

In response, the Wasabi team acted quickly: rotating keys, pausing affected contracts, and gradually restoring withdrawals for unaffected vaults in early May. They issued an official statement to the community acknowledging the Spring Boot Actuator misconfiguration as one of the main causes. As of mid‑May 2026, no final compensation plan for users has been announced, though the team stated that making all affected users whole remains their top priority, with details still under discussion.

What This Incident Teaches Us

The Wasabi Protocol incident underscores a set of hard‑earned lessons for the DeFi industry. At the top of the list is infrastructure security, which must be treated as paramount. Tools such as Spring Boot Actuator, Prometheus, and Grafana should never be publicly exposed; instead, they must require authentication, enforce IP restrictions, or be placed within private networks to mitigate the risk of information leaks.

Equally important is the principle of least privilege in on‑chain governance. Deployer accounts should avoid permanently holding unrestricted ADMIN_ROLE; adopting a multisig structure, implementing timelocks, and separating roles can significantly reduce the impact of potential key compromises.

These measures must be paired with a holistic view of security that spans both off‑chain and on‑chain environments. Poor private key management, insecure credential storage, or faulty server configurations can each become a single point of failure — and in practice, one is enough to undo an entire system.

Finally, regular security audits should not stop at smart contracts. They need to cover infrastructure and DevOps pipelines as well, ensuring that hidden vulnerabilities in deployment processes are caught before they can be exploited. The Wasabi Protocol case reminds us that no matter how advanced the technology, if security configurations and key management fall short, everything else collapses.