Unleash Protocol multisig governance hijack — Story Protocol — 2025-12-30

Summary

Unleash Protocol is a DeFi platform built on Story Protocol — an L1 launched in 2025 whose product surface tokenises intellectual-property rights. Unleash's protocol design holds user-deposited assets across multiple token classes (the chain-native WIP wrap, USDC, WETH, plus stIP and vIP staking-derivative tokens) under a multi-signature governance model in which administrative changes — including contract upgrades — are gated by signer approval through a Gnosis Safe-style multisig.

On 2025-12-30, an externally-owned address gained administrative control over Unleash's multisignature governance system through a path that PeckShield characterises as a "weakness in how admin permissions were enforced" [peckshieldunleash2025]. Once the attacker controlled the admin role, they pushed a contract upgrade that had not been approved through the protocol's normal core-team review process; the upgrade opened the path for direct withdrawal of user funds outside the approved governance flow [coindeskunleash2025] [bleepingunleash2025]. Approximately $3.9M in user funds — covering WIP, USDC, WETH, stIP, and vIP — was withdrawn to attacker-controlled addresses in the resulting drain.

The laundering chain executed within hours of the extraction. The attacker bridged the stolen assets from Story Protocol to Ethereum and deposited 1,337.1 ETH into Tornado Cash, foreclosing on-chain forensic recovery [coindeskunleash2025]. Unleash paused all protocol operations upon detection and engaged independent forensic investigators to identify the root cause and preserve on-chain data; the team's public statement explicitly clarified that Story Protocol's L1 validator set, core infrastructure, and IP-asset contracts were not compromised — the issue was scoped to Unleash's own internal governance design [unleashstatement2025].

For OAK's purposes Unleash 2025-12 anchors a distinct sub-shape of T16.005 — unauthorised-upgrade-payload via multisig-admin-boundary failure — that is structurally distinct from the established T16.005 sub-shapes (Audius 2022 storage-collision, Curio 2024 storage-collision, Tornado Cash 2023 self-modifying contract). The Unleash attack did not exploit a flaw in the proposal-payload-execution surface (which is the structural locus of the prior T16.005 sub-shapes); it exploited a flaw in the multisig admin-permission model that gates who can authorise an upgrade in the first place. The distinction matters for defender mitigation: storage-collision and self-modifying-payload sub-shapes are mitigated at the proposal-payload-review and contract-deployment-pipeline layer, whereas the multisig-admin-boundary sub-shape is mitigated at the per-signer custody layer (hardware-wallet hygiene, destination verification at sign-time, change-control delays between admin-permission grants and effective access).

Timeline (UTC)

When	Event	OAK ref
Pre-event (2025)	Unleash Protocol deployed on Story Protocol with multisig governance gating upgrade authority over deposit-holding contracts	(custody-surface precondition)
Pre-event	Externally-owned address gains administrative control via a weakness in how admin permissions were enforced in Unleash's multisignature governance system; precondition path remains under forensic investigation at v0.1 cutoff	T9.004 setup / T15-class candidate vector under investigation
2025-12-30 (attack window)	Attacker pushes a contract upgrade through the multisig that had not been approved by the core team; upgrade opens the path for direct asset withdrawal outside approved governance	T16.005 + T9.004 chain — extraction enabling step
2025-12-30 (within attack window)	Attacker withdraws WIP, USDC, WETH, stIP, and vIP from Unleash protocol contracts; cumulative loss ~$3.9M	T16.005 / T5.005-equivalent extraction
2025-12-30 (within hours)	Attacker bridges stolen assets from Story Protocol to Ethereum	T7.003 cross-chain laundering hop
2025-12-30 (within hours)	Attacker deposits 1,337.1 ETH into Tornado Cash	T7.001 mixer-routed hop
2025-12-30	Unleash detects the breach, pauses all protocol operations, publishes initial statement; PeckShield publishes on-chain attack analysis identifying Tornado Cash deposit	(operator response + public disclosure)
2025-12-30 onward	Unleash engages independent security experts and forensic investigators; investigators review multisig signer actions, key management, and governance processes; preserve on-chain data and coordinate with bridge providers	(forensic response)
2025-12-30 onward	Unleash issues clarifying statement: Story Protocol L1 contracts, validators, and underlying infrastructure are not compromised; breach scoped to Unleash internal governance design	(scope clarification)

What defenders observed

• The failure was at the multisig-admin-permission boundary, not at the proposal-payload-execution surface. Unleash's contracts were not exploited through a storage-collision attack on the governance proxy (Audius 2022, Curio 2024 anchors) or through a self-modifying proposal contract (Tornado Cash 2023 anchor); the multi-signature system's admin-permission enforcement model itself was the failure point — an externally-owned address acquired admin authority that should have been constrained by the multisig signer set [peckshieldunleash2025]. Defender threat models for multisig-governed protocols should treat admin-permission acquisition paths (signer-key compromise, signer social engineering, role-grant misconfiguration, signer-cluster takeover) as a first-class T16 attack surface separate from proposal-payload-execution surfaces.
• The chain to T9.004 is the structural one — proposal-text-vs-payload diffing does not detect this sub-shape. Defender tooling that scans proposal payloads for divergence from human-readable proposal text (the Tornado Cash 2023 mitigation surface) does not catch the Unleash sub-shape because no proposal text existed — the upgrade was pushed through admin authority directly, bypassing the normal proposal flow. The relevant detection signals are off-chain process signals (governance-change request without a corresponding forum/snapshot proposal, admin-permission grants to addresses without a published rationale, multisig-signer threshold met by a recently-rotated set) and on-chain admin-permission delta monitoring (per-block enumeration of role-grant changes in the multisig admin model) — neither of which the proposal-payload-diffing surface covers.
• The laundering rail was textbook and the recovery posture was effectively zero. The attacker bridged from Story Protocol to Ethereum and deposited into Tornado Cash within hours of extraction. The recovery profile mirrors the T16.005 cohort base rate: where the proceeds reach mixer infrastructure inside the same operational window as the extraction, on-chain recovery is structurally foreclosed regardless of the protocol team's response speed. This is the Phemex 2025 / Penpie 2024 recovery profile, not the Cetus 2025 / Euler 2023 profile (where validator-coordinated freeze or attacker-side return-of-funds shifted the outcome).
• The protocol-team response was operator-acceptable but did not move the recovery needle. Unleash paused all operations within the detection window, published a clear scope-clarification statement (Story Protocol L1 was not affected), and engaged independent forensic investigators. The pause primitive on the protocol prevents future drains but does not unwind completed extraction; the operator-side response controls the post-event exposure, not the recovery from the extracted-and-mixed value. The defender lesson is to set realistic expectations: even a textbook protocol-team response cannot recover funds that have already cleared through the mixer-routed hop.
• Attribution is pseudonymous and is the realistic attribution status for this class. PeckShield published the on-chain analysis but did not advance a named-individual claim. The 2025 multi-sig-and-governance-process-compromise cohort overall is partially DPRK-attributed (Bybit / Safe{Wallet} 2025) and partially pseudonymous-attributed; the Unleash incident sits in the pseudonymous bucket at v0.1 freeze. Contributors should not fold this case into the OAK-G01 cohort by analogy alone — the attribution surface for T16.005 is heterogeneous and cluster-graph evidence should be the bar.

What this example tells contributors writing future Technique pages

• T16.005 has a third sub-shape that prior anchors do not cover. The Audius 2022 and Curio 2024 anchors document the storage-collision sub-shape; the Tornado Cash 2023 anchor documents the self-modifying-contract sub-shape; the Unleash 2025-12 incident anchors a third, unauthorised-upgrade-payload via multisig-admin-boundary failure, sub-shape. A future v0.x update may warrant promoting this sub-shape to its own standalone T16.x sub-Technique because its mitigation surface is structurally distinct (per-signer custody hardening rather than proposal-payload review). Until then, contributors classifying similar incidents (where the failure is in who can authorise an upgrade rather than in what an authorised upgrade does) should map them to T16.005 + T9.004 with explicit reference to this sub-shape framing.
• The T9.004 chain is load-bearing here — T16.005 does not stand alone. Worked examples that document multisig-admin-boundary T16.005 failures should always chain with T9.004 (Access-Control Misconfiguration) explicitly. The Tornado Cash 2023 self-modifying-contract sub-shape chains with T9.003 (Governance Attack); the Audius / Curio storage-collision sub-shape chains with both T9.003 and T9.004; the Unleash multisig-admin sub-shape chains primarily with T9.004 because the structural failure is in access-control enforcement rather than in the governance vote tally.
• The L1-vs-protocol scope distinction is worth surfacing explicitly in similar future cases. Unleash deployed on Story Protocol; the breach was scoped to Unleash, not Story. The OAK convention from the broader DeFi-on-emerging-L1 cohort applies: contributors should be explicit about which layer (L1 validator set, L1 IP / asset contracts, deployed protocol) was compromised and which was not. This avoids unwarranted brand damage to the L1 substrate and keeps the OAK threat model accurate at the right scope.
• The mixer-routed laundering rail is the canonical recovery-foreclosure signal at v0.1 for the T16.005 class. Unleash's $3.9M proceeds reached Tornado Cash within hours of the extraction; the recovery profile is correspondingly zero. Worked examples for T16.005 incidents should treat the time-to-mixer metric as a first-class recovery-prediction signal: where the mixer hop closes inside the detection window, no operator-side response will recover the funds. Where the mixer hop is delayed by laundering-rail-availability constraints (cross-chain bridge throughput, mixer deposit caps, exchange-side blocking), partial recovery becomes possible — but Unleash's case does not exhibit those constraints.

Public references

• [peckshieldunleash2025] — PeckShield on-chain attack analysis identifying the multisig governance compromise and the Tornado Cash laundering trace; primary forensic source.
• [coindeskunleash2025] — CoinDesk reporting on the $3.9M Unleash exploit, the Tornado Cash laundering hop (1,337.1 ETH), and the affected-asset list (WIP, USDC, WETH, stIP, vIP).
• [bleepingunleash2025] — BleepingComputer coverage of the Unleash multisig hijack, the unauthorised-upgrade vector, and the operator-side response.
• [unleashstatement2025] — Unleash Protocol's public statement of the breach, the scope-clarification (Story Protocol not affected), and the engagement of independent forensic investigators.
• [cryptotimesunleash2025] — Crypto Times coverage emphasising the multi-signature governance breach framing.
• [coinpediaunleash2025] — Coinpedia coverage of the PeckShield-revealed multisig exploit; secondary press corroboration.

Discussion

The Unleash Protocol 2025-12 incident is OAK's canonical T16 2025 worked example for the unauthorised-upgrade-payload via multisig-admin-boundary failure sub-shape, and is included as a structurally distinct addition to the T16.005 anchor set. The case is positioned alongside Tornado Cash 2023 (T16.005 self-modifying-contract sub-shape), Audius 2022 (T16.005 storage-collision sub-shape), and Curio 2024 (T16.005 storage-collision sub-shape on a MakerDAO-fork governance proxy); together these four cases enumerate the three distinct T16.005 sub-shapes documented in OAK's v0.1 corpus.

The defender lesson is that T16.005 is not a single failure mode but a class with three distinct sub-shapes, each with structurally different mitigations. Storage-collision sub-shape: pre-deployment slot-layout audit + governance-proxy storage-versioning convention. Self-modifying-contract sub-shape: proposal-text-vs-payload diffing + executable-payload static analysis at proposal-submit time. Multisig-admin-boundary sub-shape (the Unleash anchor): per-signer hardware-wallet hygiene + off-chain destination verification at sign-time + change-control delay between admin-permission grants and effective access + on-chain admin-permission delta monitoring. Defender resourcing decisions should reflect that a protocol's exposure to T16.005 is multi-dimensional and cannot be summarised by any single mitigation surface.

The recovery profile is structurally identical to the broader 2025 multi-sig-and-governance-process compromise cohort: where the laundering rail closes inside the detection window through a mixer hop, on-chain recovery is foreclosed. Contributors writing future T16.005 worked examples should preserve this expectation — the T16 / T9 / T7 chain is structurally complete in the Unleash case, and the recovery posture follows from the laundering-rail timing rather than from any operator-side response choice.

The attribution status is pseudonymous and should remain so absent new public evidence. The 2025 multi-sig-and-governance-process-compromise cohort is heterogeneously attributed (Bybit / Safe{Wallet} is OAK-G01 / DPRK-attributed; Radiant Capital is UNC4736 / Citrine Sleet attributed; smaller-scale protocol incidents like Unleash typically remain pseudonymous at v0.1 freeze). Contributors should not fold Unleash into either the OAK-G01 cohort or the broader pseudonymous-actor pool by analogy alone; the cluster-graph evidence is what the bar should be.