Which exploits hit DeFi this week?

TLDR

Several DeFi exploits were reported this week: Unleash Protocols governance multisig was compromised (~$3.9M, funds mixed via Tornado Cash), Flow suffered a network exploit (~$4M) with a chain restart, and a flash?loan hit a BSC contract (~$130k).

1. Unleash Protocol governance exploit with 1,337 ETH routed to Tornado Cash per a detailed report on the incidents mechanics and losses here.
2. Flows ~$4M exploit prompted halts and a planned rollback, with major Korean exchanges placing FLOW on watchlists per this update here.
3. A flash?loan exploit on Binance Smart Chain targeted a vulnerable contract function, causing ~$130k in losses per the incident note here.

Deep Dive

1. Unleash Multisig Governance

The attacker gained administrative control via Unleash Protocols multisignature governance, pushed an unauthorized contract upgrade, and withdrew funds that were later mixed via Tornado Cash.

1. The process and loss (~1,337 ETH) are described in an incident write?up that attributes the failure to governance permissions rather than Story Protocols core infra here.
2. A complementary media alert confirms Tornado Cash deposits and outlines the pause in Unleash operations here.

2. Flow Exploit And Rollback

Flow faced an exploit near ~$3.9M that triggered network halts and a planned chain restart to a checkpoint before the attack.

1. The response included validator coordination, restart planning, and heightened scrutiny from Korean exchanges that placed FLOW on watchlists here.
2. Media coverage also noted steep price reactions and operational disruptions following the exploit here.

3. BSC Flash?Loan And Access Control

A BSC contract labeled MSCST was exploited through a missing access control in a reward function, enabling price manipulation and extraction of ~$130k.

1. The vulnerability centered on an unsecured releaseReward() path that attackers used with flash?loan liquidity, per the incident summary here.
2. This pattern underscores ongoing risks from poorly guarded functions that can be paired with capital?efficient flash?loans.

Conclusion

This weeks exploit set highlights three recurring DeFi risk vectors: governance/admin control failures, chain?level recovery trade?offs, and flash?loan?amplified contract bugs. If you track protocol risk, monitor admin?key policies, upgrade procedures, and access control on critical functions. A simple lens is to prioritize projects with strong governance safeguards, audited state checks, and clear recovery plans.