Unleash Protocol suffered an internal governance abuse, resulting in the theft of $3.9 million in assets.

According to an official announcement, the Unleash Protocol project, deployed on Story Protocol, suffered an unauthorized contract upgrade and malicious transfer of user assets today. The attacker manipulated its multi-signature governance permissions to implement the upgrade, resulting in the theft and cross-chain transfer of assets including WIP, USDC, WETH, stIP, and vIP to external addresses. The confirmed loss is approximately $3.9 million.