Unleash Protocol, an intellectual property financing platform built on the Story ecosystem, has been involved in a serious security breach. According to data shared by blockchain security firm PeckShield, approximately $3.9 million worth of crypto assets were withdrawn from the platform without authorization. The incident is believed to stem from a vulnerability in Unleash's governance structure rather than a direct smart contract error. In its initial statement, Unleash acknowledged the detection of unusual activity in its smart contracts, resulting in the withdrawal of user funds. Investigations revealed that the attacker gained administrator privileges through Unleash's multisignature (multisig) governance system. This allowed them to perform an unauthorized contract update outside the approved governance process, enabling the withdrawal of funds. Affected assets included tokens such as WIP, USDC, WETH, stIP, and vIP. The withdrawn funds were subsequently transferred to the Ethereum network using third-party bridge infrastructure. According to PeckShield's analysis, the attacker attempted to conceal the transaction history by transferring a total of 1,337.1 ETH via Tornado Cash. Tornado Cash is known as a mixing service previously used to obscure the trail of funds after numerous attacks. Unleash and the on-chain analytics firm LookonChain specifically emphasized that the incident did not stem from a technical vulnerability in Story Protocol's infrastructure. They stated that the problem arose within Unleash's own governance mechanism and that Story Protocol's core protocol was not affected by this attack. Nevertheless, Unleash's prominence within the Story ecosystem amplified the incident's impact. Following the attack, the platform announced that it had suspended all operations and launched a comprehensive investigation with independent security experts and forensic teams. Users were asked not to interact with Unleash smart contracts until further notice. They also urged caution regarding information and guidance from unofficial channels. Unleash Protocol aimed to tokenize media content, brands, and creative works by transferring intellectual property rights to the blockchain and using them in financial applications. However, Unleash, a relatively new platform, had a total locked asset value of approximately $4.4 million before the attack, and a large portion of its liquidity was quickly emptied.
IP coin price affected
The effects of the attack were also felt in the Story ecosystem. Following the news of the incident, the price of Story Protocol's native token, IP, dropped from $1.62 to $1.50. The IP token had already experienced a sharp decline in the last quarter and had moved significantly away from its peak of over $13 during the year.
Meanwhile, it is worth noting that DeFi platforms faced a constant threat of attacks throughout 2025. According to the security firm SlowMist, a total of 200 attacks were recorded during the year. Although this number shows a decrease compared to 2024, total losses exceeded $2.9 billion, showing an increase compared to the previous year. 126 of the attacks directly targeted DeFi protocols.
