On April 30, 2026, Wasabi Protocol's deployer EOA was compromised, which held the sole ADMIN_ROLE without timelock or multisig protections. The attacker executed unauthorized UUPS proxy upgrades on vaults and pools across Ethereum, Base, Berachain, and Blast, sweeping approximately $5.5M in collateral and pool balances.