Humanity Protocol Loses $36 Million in Security Breach

Humanity Protocol, a decentralized identity project utilizing palm-scan biometrics, experienced a major security breach between June 8 and June 9, 2026, resulting in the loss of over $36 million [1]. The incident, which involved the theft and unauthorized minting of H tokens across the Ethereum and BNB Smart Chain networks, caused the token's value to plummet by approximately 89% within a 24-hour period [1].

Key takeaways

• The exploit originated from a single employee’s laptop, which stored multiple bridge admin and multisig keys [1].
• Attackers drained approximately 447 million H tokens, converting them into roughly $30.8 million in ETH and $924,000 in BNB [1].
• Humanity Protocol has halted all bridge deposits and withdrawals while collaborating with security firms and law enforcement [1].
• On-chain analyst ZachXBT initially suggested the event might be staged, though later noted the exploit and suspicious market maker activity appeared to be independent events [1, 2].
• There is currently no evidence that the project’s biometric data or user identity information was compromised [3].

Operational Security Failure and Token Collapse

The breach was facilitated by a catastrophic operational security failure where an employee stored multiple sensitive administrative keys on a single device [1]. Attackers leveraged this access to steal private keys from a hot wallet, seize control of the Hyperlane bridge ProxyAdmin on Ethereum, and compromise multisig keys on the BNB Smart Chain [1]. By gaining control of the proxy admin, the attackers were able to upgrade the bridge to a malicious version and mint 300 million additional H tokens, which flooded the market and intensified the price collapse [1].

Following the attack, the H token fell from a pre-exploit price of approximately $0.67 to a low of $0.05 [1]. While the token later saw a partial recovery to around $0.21, it remained significantly lower than its valuation prior to the incident [1]. Humanity Protocol founder Terence Kwok confirmed the private key compromise and advised users to avoid interacting with the project’s bridge or liquidity pools until further notice [1, 2].

Scrutiny Over Market Activity

The incident drew immediate attention from on-chain analyst ZachXBT, who initially questioned the narrative provided by the project, suggesting the "incident" might have been a convenient cover for a market maker to exit positions [2]. However, in a follow-up analysis, ZachXBT clarified that the laundering patterns associated with the exploit did not overlap with the flows linked to the suspected market maker activity, indicating the two events were likely unrelated [2].

Why it matters

The Humanity Protocol exploit highlights a persistent vulnerability in the cryptocurrency industry: the reliance on traditional, centralized custody controls for projects built on decentralized, privacy-preserving technology [3]. While the project’s core pitch involves zero-knowledge proofs and biometric identity verification, the breach demonstrated that the security of the entire ecosystem remains tethered to the protection of administrative keys on standard hardware [3]. As the project works toward recovery, the incident serves as a reminder of the gap between cryptographic identity claims and the operational realities of managing bridge and token infrastructure [3].