Unleash Protocol hit by $3.9 million exploit with funds routed through Tornado Cash

Unleash Protocol, an intellectual property finance platform built on the Story ecosystem, lost about $3.9 million in a security breach, according to blockchain security firm PeckShield.

The attacker bridged the stolen assets to Ethereum and deposited 1,337.1 ether (ETH) into Tornado Cash, a crypto mixing service commonly used to obscure transaction histories, according to PeckShield.

Unleash had reported the breach earlier, without putting a figure on the amount.

"Earlier today, we detected unauthorized activity involving Unleash Protocol smart contracts, which led to the withdrawal and transfer of user funds," the platform said in a post on X. "Our initial investigation indicates that an externally owned address gained administrative control through Unleash’s multisignature governance system, enabling an unauthorized contract upgrade that allowed asset withdrawals outside approved governance procedures."

Assets affected include WIP, USDC, WETH, stIP and vIP, the protocol said. After the withdrawals, the funds were bridged using third-party infrastructure and transferred to external addresses.

Platforms like Unleash aim to bring intellectual property rights, such as media, brands and creative works, on-chain, enabling them to be tokenized, licensed or used as financial primitives within decentralized applications.

Both Unleash and onchain analytics firm LookonChain said the exploit appeared to stem from a governance failure at Unleash, rather than a vulnerability in Story Protocol itself.

Unleash said it paused all operations while the investigation continues and is working with independent security experts and forensic investigators to determine the root cause. Users have been advised not to interact with Unleash Protocol contracts until further notice and to follow official channels for updates.