Incident Overview
On December 30, 2025, Unleash Protocol's multisig governance was compromised, allowing an attacker to execute an unauthorized contract upgrade and drain approximately $3.9 million in various tokens (WIP, USDC, WETH, stIP, vIP), with 1337.1 ETH laundered through Tornado Cash from address 0xc946981F…15BfE3.
The incident originated within Unleash Protocol's governance and permission framework when an externally owned address obtained administrative control through the multisig system and carried out an unauthorized smart contract upgrade that enabled asset withdrawals outside the team's intended governance and operational procedures. After withdrawing the affected assets from Unleash contracts, the attacker utilized third-party bridge infrastructure to move funds cross-chain before transferring them to external addresses and ultimately laundering 1337.1 ETH through Tornado Cash. The investigation found no evidence of compromise to Story Protocol contracts, validators, or underlying infrastructure, with the impact appearing limited to Unleash-specific contracts and administrative controls.
In response, Unleash immediately paused all protocol operations, engaged independent security experts and forensic investigators to determine the root cause, initiated a full review of multisig signer activity and key management practices, and began coordinating with ecosystem partners and infrastructure providers while preserving on-chain data for analysis.
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Unleash Protocol, these are the critical security checks that could have prevented this incident (December 2025).
- Verify all logic paths related to Multisig Governance Hack / Access Control are guarded by proper access controls and input validation - see the Access Control Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Unleash Protocol
The Unleash Protocol hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.