A developer leaked private deployment keys to GitHub, which an attacker exploited to drain $375K from the unshETH staking protocol. The attacker transferred ownership of smart contracts to themselves before the protocol emergency-paused withdrawals and the keys were secured.

The LSDFi protocol unshETH stated that at around 22:00 on May 31, one of the deployment private keys of the unshETH contract was leaked. For the sake of caution, the official has urgently suspended the withdrawal of unshETH's ETH. According to the security model, unshETH's ETH deposit (TVL up to 35 million US dollars) is protected by multi-signature + time lock and is not at risk.