Unleash Protocol suffered an internal governance abuse, resulting in the theft of $3.9 million in assets.

PANews reported on December 30th that, according to an official announcement, the Unleash Protocol project, deployed on Story Protocol, suffered an unauthorized contract upgrade and malicious transfer of user assets today. Attackers manipulated multi-signature governance permissions to implement the upgrade, resulting in the theft and cross-chain transfer of assets including WIP, USDC, WETH, stIP, and vIP to external addresses. The confirmed loss is approximately $3.9 million. Unleash has suspended all operations and launched a full investigation and audit process, urging users to refrain from interacting with its contracts. Story Protocol itself was unaffected.