Unleash Protocol drained of $3.9M after governance exploit

Unleash Protocol, an intellectual property finance platform on the Story ecosystem, was hit by a governance exploit that drained roughly $3.9 million, according to on-chain analysis from blockchain security firm PeckShield. The attacker obtained administrative control through Unleash’s multisignature governance, upgraded a contract, withdrew assets, bridged them to Ethereum and later deposited 1,337.1 ether into Tornado Cash, a mixing service that obscures transaction histories.

Unleash disclosed that an externally owned address gained admin rights via its multisig and used that access to push an unauthorized upgrade, enabling withdrawals outside approved procedures. “Earlier today, we detected unauthorized activity involving Unleash Protocol smart contracts,” the team wrote on X.

The project listed affected assets as WIP, USDC, WETH, stIP and vIP. Operations have been paused while independent security experts and forensic investigators review the incident. Users were urged to avoid interacting with Unleash contracts and to await further updates.

Both Unleash and on-chain analytics firm LookonChain assessed that the exploit stemmed from a governance failure at Unleash, not a vulnerability in Story Protocol. The platform aims to bring intellectual property rights such as media, brands and creative works on-chain for tokenization, licensing or use in decentralized finance.

As we reported earlier, a wave of on-chain and exchange hacks in 2025 stole about $2.2 billion in the first half of the year, exceeding all of 2024. Investors and European enterprises have been buying hardware wallets at a record pace, moving funds off exchanges and hot wallets hit by credential thefts and front-end exploits.