Humanity Protocol Loses $36M After Personal Keys ‘Compromised,’ Token Crashes 73%

Humanity Protocol’s native token H collapsed greater than 80% Tuesday after attackers compromised private keys tied to the mission, seized bridge admin controls, and stole greater than $36 million throughout Ethereum and BNB Chain.

In a detailed threadHumanity Protocol stated the Monday assault was coordinated throughout Ethereum and BSC and traced to a breach that occurred “after an worker’s laptop computer was compromised.”

The Humanity breach extends one of many worst stretches on record for DeFi securitywith greater than $885 million misplaced to DeFi hacks within the first six months of 2026, based on DeFiLlama data.

Attackers compromised three of six Gnosis Secure keys on Ethereum and three of 5 on BSC, seizing ProxyAdmin management, draining about 141.2 million H, and minting one other 200,000,005 H by malicious contract upgrades, based on the mission.

The mission’s H token plunged from highs of $0.73132 Monday to a Tuesday morning low of $0.079606, per CoinGecko dataa drop of 89%. H is presently buying and selling close to $0.20, down 73% on the day, erasing a lot of a rally that had pushed the token near its all-time excessive of $0.80 only a week earlier.

Founder Terence Kwok confirmed the breach and informed customers to remain away from the mission’s infrastructure.

Humanity Protocol is a zero-knowledge Layer-2 blockchain centered on decentralized identification, based by Kwok and constructed round a “Proof of Humanity” system that verifies customers by palm scans relatively than iris or facial recognition.

The breach is the most recent setback for Kwok, whose earlier enterprise, hospitality-tech startup Tink Labs, raised about $160 million and have become one among Hong Kong’s first unicorns before shutting down in 2019 amid monetary troubles.

The Humanity Protocol workforce stated it has halted deposits and withdrawals to the affected bridges and is working with exchanges and police to recuperate funds.

“Folks on this neighborhood labored laborious for what they maintain right here, and we really feel the load of that,” the mission stated, promising a autopsy.

An “operational safety failure”

Meir Dolev, co-founder and CTO at blockchain safety platform Cyvers, informed Decrypt the incident was “an operational safety failure, not a smart-contract bug,” with the attacker gaining admin entry by a non-public key tied to a Humanity Basis member.

After the contract improve, Dolev stated the attacker abused the mint operate to create 100 million new H, price about $12.9 million, then swapped the stolen and minted tokens for ETH and BNB earlier than consolidating throughout a number of wallets.

Dolev famous that draining roughly $30 million “required proprietor/admin-level management in a position to enhance token provide by way of the proxy contract improve and drain protocol-controlled wallets immediately.”

“The core failure is structural: one key trusted with each the funds and the ability to rewrite the foundations,” he stated.

He learn Kwok’s warning to keep away from the bridge and swimming pools as an indication that entry “is probably not absolutely contained.”

The attacker nonetheless holds massive quantities of H however can not absolutely money out as a result of pool liquidity is simply too skinny to soak up the swaps, Dolev stated, making the general public alert “partly an effort to maintain that liquidity from being touched.”

Humanity Protocol is because of unlock 266.5 million H, about 9.4% of the launched provide, price roughly $33 million at pre-crash costs, on June 25, throughout six allocations, based on Tokenomist data.

On-chain sleuth ZachXBT initially flagged the occasion as “probably staged,” suggesting it provided a handy exit for the energetic market maker.

He later walked the assertion again, tweeting that, “After additional evaluation of the laundering, it appears the sketchy MM / OTC & personal key compromise are impartial of each other and never associated.”

Dolev cautioned that on-chain proof to this point stays blended, for the reason that attacker holds reliable admin rights both manner. The place the funds settle within the coming days, and whether or not the compromised key was dormant beforehand, he stated, “would be the deciding issue.”