Unleash Protocol: Exploitation of Governance Controls Leaves a Balance of 3.9 Million in Losses

Through a statement published on December 30th, the ecosystem built on Story Protocol confirmed that it faced a critical security incident. A malicious actor managed to compromise privileges assigned in the multi-signature governance system, gaining unauthorized access to execute changes in smart contracts.

Details of the Attack and Compromised Assets

The exploit allowed the attacker to transfer user funds to external addresses, moving cross-chain assets including WIP, USDC, WETH, stIP, and vIP. The total amount stolen is approximately $3.9 million, a figure that continues to be evaluated as the audit progresses.

The incident highlights how misconfiguration of authorization privileges can become a lethal attack vector for DeFi projects, enabling the attacker to bypass security layers designed to protect funds.

Immediate Response and Next Steps

Unleash Protocol has fully paused its operations while conducting a thorough investigation. The platform has advised its users to refrain from any interactions with the contracts until the forensic analysis is complete.

An important note: Story Protocol, the blockchain on which the compromised project was deployed, suffered no damage. The vulnerability was specific to the Unleash contract and does not affect the security of the underlying infrastructure.

This event underscores the importance of rigorous audits, penetration testing, and robust configurations in governance mechanisms, especially in projects handling significant liquidity.