Unleash Protocol Loses $3.9 Million in Governance Exploit

December 30, 2025 — Unleash Protocol, a decentralized intellectual property platform built on Story Protocol, has suffered a major governance exploit that resulted in losses of approximately $3.9 million. The incident occurred after attackers compromised a multi-signature governance wallet, gained unauthorized upgrade permissions, and drained protocol funds.

Within hours, the stolen assets were bridged to Ethereum and routed through Tornado Cash, significantly complicating recovery. While the Story Protocol base layer remained secure, market confidence took a hit. The $IP token dropped nearly 10 percent but recovered all the drop with a new push.

<<-chart-story-2->

Security firms including PeckShield flagged the exploit as another example of governance-level failures overtaking smart-contract bugs as DeFi’s primary risk vector.

How the Unleash Protocol Exploit Happened?

The attack targeted Unleash Protocol’s governance layer rather than its core smart contracts. Investigators believe the attacker gained unauthorized access to the protocol’s multi-sig wallet, which controls contract upgrades and treasury permissions.

Once control was obtained, the attacker executed a malicious upgrade. This change enabled rapid fund extraction from the protocol’s treasury. The entire sequence unfolded in under an hour.

Next, the attacker bridged the assets from the Story ecosystem to Ethereum. Finally, they routed the funds through Tornado Cash using multiple transactions to obscure on-chain trails.

This pattern mirrors a growing trend in 2025. Instead of exploiting code bugs, attackers now manipulate governance processes, signers, or proposal workflows.