2025-12-30 09:30:14

Unleash Protocol encounters a smart contract security incident. It is reported that the project's multi-signature governance mechanism experienced an anomaly—an external address somehow gained management privileges, and then executed a contract upgrade without authorization, directly leading to the illegal extraction and transfer of user assets.

Specifically, where did the problem in this incident lie? According to preliminary investigations, the attacker bypassed the defense line through Unleash's multi-signature governance process and gained management rights to the smart contract. With this permission, they bypassed the normal approval process and forcibly executed the contract upgrade. This upgrade operation directly opened the door for asset extraction—users' funds were quietly transferred away.

The project team has now confirmed that some assets have been affected. This incident serves as a warning to DeFi users once again: multi-signature mechanisms may seem secure, but if the governance logic has vulnerabilities or permissions are improperly configured, they can still be exploited. For users involved in similar projects, this is a case worth paying attention to.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

10 Likes

Reward
10
5
Repost
Share

Comment

0/400

LiquidatedNotStirred

· 5h ago

Another multisig story, same old trick Multisig is just a paper tiger... Once permission configurations slacken, security is immediately compromised That's why I absolutely refuse to touch governance tokens of small projects, they're way too dangerous

View OriginalReply0

IfIWereOnChain

· 5h ago

It's another case of multi-signature taking the blame; this thing really can't be trusted. This time with Unleash, it reminded me that multi-signature is just a paper tiger; the key still depends on the skill level of the implementers. Permission configuration is truly an old pitfall; how come projects still stumble over it?

View OriginalReply0

ShitcoinArbitrageur

· 5h ago

Multi-signature can't even stop it? That's outrageous, it feels like every time it's just a permissions issue causing the explosion. Another project that "passed security audit" hahaha, I don't believe you. How unlucky are Unleash users this time... funds just disappeared when they said so. Contract upgrades are indeed a trap; governance parameters need to be closely monitored. DeFi is all about outsmarting hackers; it's terrifying.

View OriginalReply0

AirdropGrandpa

· 5h ago

It's another multi-signature issue, and this time Unleash was directly exposed. This contract vulnerability is really incredible. Is permission configuration so casual? Fortunately, I didn't get involved with this. It seems that these kinds of projects are becoming increasingly unsafe. Multi-signature is unreliable; who can we rely on for endorsement? Funds have been moved again. DeFi really puts on a big show every day.

View OriginalReply0

GateUser-2fce706c

· 5h ago

I've always said that these new projects carry high risks, and multi-signature is not a cure-all. The key is whether the team is reliable or not. This wave of correction is the real screening moment. When bottom-fishing, choose top-tier projects. Retail investors are most likely to get caught in traps. Permission configuration may sound simple, but it's hard to implement. Many project teams don't take security seriously at all. The threshold for DeFi is right here. Without risk awareness, you really can't play. Another project爆雷, I'm done... Looks like I still need to keep an eye on audit reports. That's why I never touch small coins that I don't know well. Don't even try to get an early lead.

View OriginalReply0