Unleash Protocol Hack

On December 30, 2025, Unleash Protocol's multisig governance was compromised, allowing an attacker to execute an unauthorized contract upgrade and drain approximately $3.9 million in various tokens (WIP, USDC, WETH, stIP, vIP), with 1337.1 ETH  laundered through Tornado Cash from address 0xc946981F…15BfE3.

The incident originated within Unleash Protocol's governance and permission framework when an externally owned address obtained administrative control through the multisig system and carried out an unauthorized smart contract upgrade that enabled asset withdrawals outside the team's intended governance and operational procedures. After withdrawing the affected assets from Unleash contracts, the attacker utilized third-party bridge infrastructure to move funds cross-chain before transferring them to external addresses and ultimately laundering 1337.1 ETH through Tornado Cash. The investigation found no evidence of compromise to Story Protocol contracts, validators, or underlying infrastructure, with the impact appearing limited to Unleash-specific contracts and administrative controls.

In response, Unleash immediately paused all protocol operations, engaged independent security experts and forensic investigators to determine the root cause, initiated a full review of multisig signer activity and key management practices, and began coordinating with ecosystem partners and infrastructure providers while preserving on-chain data for analysis.

Attacker Address: 0xc946981F…15BfE3

Tx: storyscan.io/tx/0x2cb543fd…0ab6c3