Wasabi Protocol disclosed a security breach in which attackers exploited a vulnerability in its AWS infrastructure to obtain private keys controlling its smart contracts, resulting in the theft of approximately $5.7 million on April 30, 2026. About $4.8 million was taken from user funds and $900,000 from the project treasury across EVM vaults on Ethereum, Base, Blast, and Berachain; Solana deployments and Prop AMM were not affected. Wasabi states the vulnerability has been contained and unaffected vaults resumed withdrawals on May 2, with ZeroShadow engaged to trace the stolen funds. The reported issue concerns Wasabi's use of AWS rather than a confirmed flaw in AWS itself, and no AWS-side advisory has been published. No definitive user compensation plan has been announced.
// Alert
AWS threat report
// AWSMEDIUM
// Get alerts for AWS