Humanity Protocol, a blockchain identity project valued at $1.1 billion in its January 2025 funding round, lost $36 million in H tokens on June 8-9, 2026, after an attacker compromised a single employee laptop that stored enough multisig keys to breach bridges on both Ethereum and BNB Chain. The ...
"The core failure is structural: one key trusted with both the funds and the power to rewrite the rules." — Meir Dolev, Co-founder and CTO, Cyvers
Humanity Protocol, a blockchain identity project valued at $1.1 billion in its January 2025 funding round, lost $36 million in H tokens on June 8-9, 2026, after an attacker compromised a single employee laptop that stored enough multisig keys to breach bridges on both Ethereum and BNB Chain. The H token fell 89% intraday — from $0.73 to $0.08 — and has since partially recovered to approximately $0.20.
The incident exposed a fundamental operational failure: a 3-of-6 Gnosis Safe multisig on Ethereum and a 3-of-5 Safe on BNB Chain both had their threshold keys stored on the same device. The attacker seized ProxyAdmin control, deployed malicious contract upgrades, drained 141.2 million H tokens from Ethereum, and minted 300 million new tokens on BNB Chain. Total impact reached approximately 447 million H tokens across three attack vectors.
The breach adds to a pattern. Bridge exploits have accounted for $340.7 million in losses across 14 incidents in 2026 alone. Private key compromises represented 88% of stolen funds in Q1 2025, according to Hacken. Humanity Protocol had no public audit from CertiK or any other firm, no disclosed bug bounty program, and no verified KYC for its team — deficiencies visible on CertiK's Skynet before the attack occurred.
On June 8, 2026, an attacker gained access to an employee laptop belonging to a Humanity Foundation member. The device contained private keys for multiple signers across two multisig wallets. The attack unfolded across three distinct vectors:
Vector 1 — Direct Key Compromise: Approximately 6 million H tokens were stolen directly using compromised private keys.
Vector 2 — Ethereum Bridge Exploit: The attacker used 3 of 6 compromised Gnosis Safe owner keys to transfer ownership of the Ethereum bridge's ProxyAdmin contract. A malicious bridge implementation was deployed, and 141.2 million H tokens were drained in a single transaction. According to Humanity Protocol's post-mortem, the malicious contract upgrade allowed direct transfers from victim wallets.
Vector 3 — BNB Chain Token Minting: Using 3 of 5 compromised Safe keys on BNB Chain, the attacker seized ProxyAdmin control, upgraded the token contract, and executed unauthorized mint transactions. Two batches of 100 million tokens each — 200 million total — were created. An additional 100 million H tokens were minted after the attacker transferred ownership of the token admin contract through the compromised multisig. Total unauthorized minting reached 300 million tokens.
Proceeds were liquidated through Uniswap, PancakeSwap, and Kyber, then consolidated across 17+ tracked wallets. As the post-mortem confirmed: "All actions performed by the attacker used legitimately authorized private keys." The smart contracts functioned as designed. The failure was entirely operational.
Humanity Protocol founder Terence Kwok acknowledged that "some of the keys were accidentally backed up to a compromised device during setup." The team had intended to distribute the multisig across four individuals, but during implementation, multiple keys ended up on one machine.
The H token experienced one of the sharpest single-day collapses of 2026:
| Metric | Value | |--------|-------| | Pre-attack price | ~$0.73 | | Intraday low | ~$0.05 | | Post-stabilization | ~$0.20 | | Peak-to-trough decline | 89% | | Daily decline (close-to-close) | 73% |
The collapse erased roughly $500 million in market capitalization within hours. An estimated 190 million H tokens were drained from 280+ wallets on the Ethereum side, while the BNB Chain minting inflated the total supply by 300 million tokens — diluting existing holders and destroying confidence in the token's monetary integrity.
The attack timing raised additional concerns. H had rallied approximately 400% in under five days in late May 2026, surging from $0.20 to over $0.70 ahead of a scheduled token unlock of 266.5 million vested tokens for team and investors on June 25. Blockchain investigator ZachXBT called the incident a "very convenient exit" for an active market maker, though he later walked back accusations of direct team involvement after additional on-chain analysis. He noted it was "funny if the team was pumping the token for weeks only to have gotten rekt shortly before the upcoming unlock."
Yearn developer Banteg described the 14-hour window between the Ethereum wallet compromise and key rotation as concerning, stating the lag made an "inside job plausible."
A multisignature wallet is a security mechanism designed to distribute trust. A 3-of-6 configuration means three separate key holders must approve a transaction. The security model assumes key holders are distinct individuals operating on distinct devices in distinct environments.
Humanity Protocol's implementation violated each of these assumptions. Mikko Ohtamaa, co-founder of Trading Strategy, summarized the failure: the protocol "was hacked. 3 of their 6 multisig key holders were the same person."
The structural failure had three dimensions:
Key concentration: Multiple keys assigned to different signers were backed up on a single laptop. This collapsed the 3-of-6 threshold to a single point of compromise.
No hardware isolation: Industry best practice requires hardware security modules (HSMs) or hardware wallets for multisig keys. Storing keys in software on a general-purpose laptop eliminates the air gap that protects against malware, phishing, and device theft.
No operational monitoring: The Ethereum wallet remained compromised for 14+ hours before key rotation was attempted. No automated alert triggered on the anomalous ProxyAdmin ownership transfer — a transaction type that should immediately raise flags in any monitoring system.
Meir Dolev, CTO at Cyvers, told Decrypt the incident was "an operational security failure, not a smart-contract bug." He emphasized the structural problem: the same key was trusted with "both the funds and the power to rewrite the rules."
Multiple risk signals were publicly visible before the attack:
No audit: CertiK's Skynet profile for Humanity Protocol listed the project as unaudited — no CertiK audit, no third-party audit, no bug bounty program, and no team KYC verification. For a $1.1 billion-valued project holding tens of millions in bridge reserves, the absence of a security audit is a material risk factor.
Funding profile: Humanity Protocol raised $50 million across three rounds from investors including Pantera Capital, Jump Crypto, Kingsway Capital, and Shima Capital. The most recent round valued the project at $1.1 billion in January 2025. Despite this funding, no public evidence of a comprehensive security audit existed.
Team concerns: On-chain analyst SpecterAnalyst had claimed prior to the hack that "three of four leads have questionable pasts involving mismanagement, lawsuits, or financial wrongdoing." The project removed its team page from its website following the exploit.
Token mechanics: The 400% pre-hack rally occurred on low liquidity, with an imminent unlock of 266.5 million tokens — conditions that concentrate risk and amplify the impact of any sell event.
Security firm Beosin publicly questioned whether the incident constituted a "rug pull," though no definitive evidence of coordinated insider action has been presented.
The Humanity Protocol exploit is not an isolated incident. It fits a pattern that the industry has failed to break:
2025: According to Hacken, $2 billion was lost to Web3 hacks in the first half of 2025 alone. Multisig failures dominated. The Bybit breach — $1.46 billion — occurred when a compromised Safe wallet interface tricked authorized signers. Private key compromises accounted for 88% of stolen funds in Q1 2025. Chainalysis reported that total crypto theft in 2025 reached $3.4 billion, with North Korean hackers responsible for $2.02 billion — a 51% increase year-over-year.
2026 year-to-date: Bridge exploits have totaled $340.7 million across 14 incidents, according to SpazioeCrypto. The largest: Kelp DAO's LayerZero bridge ($292 million, April 19) and Drift Protocol ($285 million, April 1 — a six-month social engineering operation by a North Korean group targeting admin key holders). May 2026 alone saw $84 million in hack-related losses.
The pattern is consistent: attackers target the people who hold keys, not the code that keys protect. The Multichain exploit (2023, CEO-controlled keys), Orbit Chain (2024, 7 of 10 keys compromised), Bybit (2025, compromised signing interface), and now Humanity Protocol (2026, single laptop) all share the same root cause — human operational failure in key management.
Humanity Protocol took the following actions post-exploit:
As of June 10, no reimbursement plan for affected token holders has been disclosed. The attacker retained ongoing control and minting capability on the BNB Chain side for a period before team remediation. No arrest or fund recovery has been publicly confirmed.
The Humanity Protocol exploit cost $36 million and destroyed 89% of token value in hours. The root cause was not a zero-day vulnerability, a novel attack technique, or a flaw in cryptographic primitives. It was keys on a laptop.
The broader data is unambiguous: private key compromises, not smart contract bugs, drive the majority of losses in the Web3 ecosystem. The Bybit breach ($1.46 billion), Drift Protocol ($285 million), Kelp DAO ($292 million), and now Humanity Protocol ($36 million) all trace to operational failures in how keys are stored, distributed, and monitored.
For a protocol that raised $50 million from tier-one investors at a $1.1 billion valuation, the absence of a security audit, a bug bounty program, and basic multisig hygiene is difficult to explain. The economic value — real user funds, real market capitalization — was guarded by a security architecture that failed its most basic test.
The lesson is not new. The lesson is that it keeps needing to be relearned.