Which DeFi hacks happened this week?

TLDR

Two notable DeFi incidents this week: the Unleash Protocol multisig exploit and a smaller breach at DeBot, an AI trading tool.

1. Unleash Protocol halted after a multisig governance exploit moved about 1,337 ETH (~$3.9M) to Tornado Cash per a security report.
2. DeBot lost about $255,000%%CKPROTECTED2%% after an exploited server, with the team pledging to compensate users, as covered in a market update.

Deep Dive

1. Unleash Protocol Exploit

Unleash paused all on-chain activity after an attacker gained administrative control via the multisig, pushed an unauthorized contract upgrade, and siphoned assets that were later funneled to Tornado Cash. The team advised users not to interact with contracts while it engaged external investigators and reviewed signer activity and key management. The report notes no evidence of compromise to Story Protocols underlying infrastructure, suggesting the impact was limited to Unleashs contracts and admin controls per the security report.

2. DeBot Server Breach

DeBot, an AI?based DeFi trading tool, reported losses of roughly $255,000%%CKPROTECTED2%% tied to an exploited server in Japan and said it would make affected users whole. The incident was cited alongside a string of third?party or client?side security issues, with additional commentary warning that DEX bots and custodial workflows that require cloud?stored keys increase risk, according to a market update.

Conclusion

This weeks DeFi losses skewed toward governance and infrastructure weaknesses rather than core smart?contract logic. The common thread is control plane compromise, not protocol math. If you use affected apps, follow official updates, pause interactions until remediations are confirmed, and prefer setups that minimize privileged key risk.