Unleash Protocol Hack

What happened

On December 30, 2025, an externally owned address gained administrative control through Unleash Protocol's multisignature governance and pushed an unauthorized contract upgrade. The change allowed withdrawals outside approved governance procedures, with losses reported at about $3.9 million across WIP, USDC, WETH, stIP and vIP.

How it happened

1. An external address obtained administrative control through the multisignature governance system.
2. It executed an unauthorized contract upgrade.
3. The upgrade enabled withdrawals outside the protocol's approved governance procedure.
4. The withdrawn assets were bridged to Ethereum; reporting says 1,337.1 ETH was deposited into Tornado Cash.

Protocol details

Classification Protocol Logic / NFT / Other / Key Compromise

Protocol Type Lending

Implementation language Solidity

Protocol links Website @UnleashProtocol

Security review history

• Halborn View report
• BlockSec View report

Evidence

• report @UnleashProtocol incident report x.com
• report @CertiKAlert incident report x.com
• analysis DeFiLlama defillama.com
• analysis Unleash Protocol hit by $3.9 million exploit with funds routed through Tornado Cash coindesk.com

Understand the attack patterns

Compare incidents →

Access Control Attacks