On December 30, 2025, Unleash Protocol was exploited when an attacker compromised the multisig governance system and deployed a malicious contract. The attacker siphoned $3.9M in assets, bridged them to Ethereum, and laundered them via Tornado Cash.

The Unleash Protocol project deployed on Story Protocol suffered an unauthorized contract upgrade, followed by the malicious transfer of user assets. The attacker manipulated the project’s multisig governance privileges to perform the upgrade, resulting in the theft and cross-chain transfer of assets including WIP, USDC, WETH, stIP, and vIP to external addresses. The currently confirmed loss is approximately USD 3.9 million. Unleash has suspended all operations and initiated a full investigation and audit process, urging users to refrain from interacting with its contracts. Story Protocol itself remains unaffected.