Crypto heist pilfers about $3.9M from Unleash Protocol

BleepingComputer reports that Unleash Protocol, a decentralized intellectual property platform, has disclosed the theft of nearly $3.9 million worth of cryptocurrency following the takeover of its multisig governance, which allowed an unauthorized smart contract upgrade.

With the unpermitted smart contract upgrade, attackers were able to withdraw USDC, wrapped IP, stacked IP, voting-escrowed IP, and wrapped Ether assets, according to Unleash Protocol. Third-party infrastructure was noted by PeckShieldAlert researchers to have been used to bridge the exfiltrated assets to Ethereum before being deposited to cryptocurrency mixing service Tornado Cash, which had sanctions over its involvement in laundering North Korean ransomware proceeds repealed by the U.S. earlier last year.

All operations of Unleash Protocol have been halted amid an ongoing investigation into the intrusion alongside third-party security analysts, as well as an assessment of incident remediation and recovery efforts.