logo

Hackers drain $3.9M from Unleash Protocol after multisig hijack

ID: 35e4fba5-3865-53c0-997c-4597f279f0ab

STIX ID: report--35e4fba5-3865-53c0-997c-4597f279f0ab

Feed Name: Bleeping Computer

Threat Score
70/100

Date Published: 2025-12-31

Date Updated: 2026-04-20

Author: Bill Toulas

...
...

Unleash Protocol suffered an unauthorized smart contract upgrade after an externally owned address gained administrative control of its multisig governance, enabling withdrawals that resulted in roughly $3.9M in stolen crypto (WIP, USDC, WETH, stIP, vIP). The attacker bridged assets to external addresses and deposited 1,337 ETH into Tornado Cash to obfuscate funds; Unleash has paused operations and engaged external security experts to investigate and remediate.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.