Unleash Protocol has announced an unauthorized activity within its smart contracts, leading to the extraction and transfer of user funds. An initial investigation revealed that an external address gained management access through Unleash's multi-signature governance mechanism and executed an unauthorized contract upgrade, triggering unapproved asset withdrawals. Affected assets include WIP, USDC, WETH, stIP, and vIP, which were subsequently moved to an external address via third-party cross-chain infrastructure. Unleash stated that the incident stems from its governance and permission framework, with no evidence suggesting that Story Protocol's contracts, validators, or underlying infrastructure were impacted. The issue appears confined to Unleash's contracts and management permissions. All protocol operations have been suspended pending further investigation.