Unleash Protocol Hacker Siphons $3.9M Bounty Through Tornado Cash
Another day, another crypto exploit—but this one's exit strategy is raising eyebrows.
The digital trail goes cold as a hacker, having just pocketed a multi-million dollar bounty from a protocol breach, doesn't just vanish into the ether. Instead, they take a detour through the web3 equivalent of a money-laundering car wash.
The Privacy Play
Forget hiding in plain sight. This actor opted for cryptographic obfuscation, routing the lion's share of their haul through Tornado Cash. The mixer scrambles the transaction trail, making the funds nearly impossible to trace back to their illicit origin. It's a stark reminder that in decentralized finance, anonymity is a feature, not a bug—even for those exploiting the system.
The Irony of the Bounty
Here's the kicker: the funds were a 'bounty' paid by the protocol itself—a common practice to white-hat hackers who expose vulnerabilities. This time, the recipient blurred the line, taking the reward and then effectively erasing their footsteps. It's a move that cuts to the heart of crypto's trust paradox: protocols pay to secure themselves, but can't control what happens after the money leaves their treasury.
The whole episode feels like a cynical jab at the 'code is law' ethos—where a payout for finding a flaw gets washed faster than a Wall Street banker's conscience.
Unleash hack could slow down Story Protocol
Story Protocol may slow down its development, as Unleash was among its top apps. Story Protocol aimed to build the infrastructure for intellectual property. Story Protocol created another L1 chain, setting out to build its own ecosystem.
At the end of 2025, Story Protocol held $8M in liquidity and $2.69M in stablecoins. In the past week, the protocol saw an outflow of over 24% of its stablecoins, independent of the Unleash Protocol hack.
The Story Protocol ecosystem contains relatively smaller apps. However, the Unleash hack shows that even small protocols are watched for potential exploits and errors in smart contracts.
Following the exploit announcement, the native Story protocol token IP fell from $1.62 to $1.50. IP unraveled in the past quarter, from a yearly peak above $13.
SlowMist counted 200 exploits in 2025
According to SlowMist, 2025 saw 200 incidents of hacks against protocols, down from over 400 incidents for 2024. Despite this, the hackers managed to attack bigger liquidity hubs, for a total loss of over $2.9B, up from $2B in 2024.
The recent attacks were more sophisticated, even when affecting relatively small protocols. Hackers targeted smart contracts, attacking DeFi platforms and liquidity pools. One of the main methods was to seek ways to make unauthorized withdrawals or mint tokens through a flawed smart contract.
DeFi was the most frequently attacked type of project, with 126 incidents for the past year. The attacks ranged from small-scale token theft to draining leading apps like Cetus. DeFi exploits drained around $649M, while the incidents on centralized exchanges were the main source of value for exploiters, with over $1.8B for the past year.
Want your project in front of crypto’s top minds? Feature it in our next industry report, where data meets impact.
