How exactly did the attacker execute the exploit wasabi?

[cryptobro]

The attacker identified that wasabideployer.eth was the sole address holding ADMIN_ROLE in Wasabi's PerpManager AccessManager, with no timelock or multisig protection. By calling grantRole on the deployer externally owned account with zero delay, the attacker instantly elevated their orchestrator contract to admin status. With admin control secured, they used the protocol's UUPS upgrade mechanism to replace the legitimate vault implementations with a malicious version that drained user balances. The entire attack chain from admin access to fund drainage was made possible by a single unprotected key holding the most powerful permission in the system.

[madtrader]

A single EOA holding ADMIN_ROLE with no timelock, no multisig, and no delay on grantRole is not a sophisticated vulnerability, it is a governance architecture failure that any security review should have flagged as a critical risk before deployment.