The attacker identified that wasabideployer.eth was the sole address holding ADMIN_ROLE in Wasabi's PerpManager AccessManager, with no timelock or multisig protection. By calling grantRole on the deployer externally owned account with zero delay, the attacker instantly elevated their orchestrator contract to admin status. With admin control secured, they used the protocol's UUPS upgrade mechanism to replace the legitimate vault implementations with a malicious version that drained user balances. The entire attack chain from admin access to fund drainage was made possible by a single unprotected key holding the most powerful permission in the system.