Executive Summary
On April 30, 2026, the on‑chain perpetual futures protocol Wasabi suffered a coordinated exploit that drained more than $5 million from its smart contracts. The attack spanned four blockchain networks—Ethereum, Base, Berachain, and Blast—highlighting the growing complexity of cross‑chain security risks. Security firm PeckShield disclosed the breach on X, and Wasabi promptly warned users to halt all interactions with its contracts while a forensic investigation unfolds.
What Happened
PeckShield reported that malicious actors leveraged a vulnerability in Wasabi’s contract architecture to siphon funds from multiple deployment layers. The exploit was first announced on X on April 30, where the security firm shared technical details of the breach. In a separate X post, Wasabi confirmed the incident, labeling it an “issue” that is under active investigation and urging its community to refrain from any contract calls.
The loss crosses several blockchain ecosystems. On Ethereum, the primary settlement layer, attackers moved a substantial portion of the stolen assets. Parallel drains occurred on Base, a Layer‑2 solution, as well as on the newer Berachain and Blast networks, indicating that the vulnerability was not confined to a single chain but was embedded in Wasabi’s cross‑chain protocol logic.
Background / Context
Wasabi is a decentralized platform that offers perpetual futures contracts directly on‑chain, allowing traders to gain leveraged exposure without relying on centralized intermediaries. Its design hinges on smart contracts that lock collateral, calculate funding rates, and settle positions automatically. To reach a broader user base, Wasabi deployed parallel contract suites on multiple blockchains, each mirroring core functionality while adapting to the specific execution environments of Ethereum, Base, Berachain, and Blast.
The protocol’s multi‑chain approach has been praised for its ambition to bring high‑frequency derivatives trading to emerging ecosystems. However, the same ambition introduces a larger attack surface: any flaw in the shared logic can be amplified across all supported chains.
Reactions
PeckShield’s announcement on X was concise, focusing on the technical takeaway that the exploit leveraged a cross‑chain contract interaction flaw. The firm did not disclose the exact method, but it emphasized the need for rapid code audits across all affected deployments.
Wasabi’s response was immediate. In its public statement, the team described the event as an “issue” and advised users to stop interacting with its contracts until the investigation concludes. The protocol’s developers also indicated that they are collaborating with external auditors and security researchers to pinpoint the vulnerability and to remediate the breach.
What It Means
The incident underscores the heightened risk that multi‑chain DeFi projects face. While expanding to newer networks can attract fresh liquidity, it also requires rigorous, synchronized security reviews for each deployment. A single oversight can cascade, exposing assets across all chains that share the same code base.
For the broader DeFi ecosystem, the hack serves as a reminder that cross‑chain composability—often touted as a strength—can become a liability if not managed with robust safeguards. Auditors and developers may need to adopt more granular testing frameworks that simulate attacks across heterogeneous environments simultaneously.
What Happens Next
Wasabi has pledged to continue its investigation and to release updates as new findings emerge. The protocol is expected to engage third‑party auditors for a comprehensive post‑mortem, and it may consider pausing further deployments on the affected chains until the root cause is fully understood.
Stakeholders—including liquidity providers, traders, and ecosystem partners—are watching closely for any remediation roadmap. The outcome will likely influence how other multi‑chain DeFi projects approach security testing and risk disclosure in the coming months.