Humanity Protocol hack wipes $36 M from H token after laptop breach

Humanity Protocol confirmed that a breach of an employee’s laptop exposed private keys, allowing attackers to seize bridge admin controls and steal more than $36 million worth of its H token [2]. The exploit, which unfolded on June 8, involved draining 141.2 million H on Ethereum and minting an additional 200 million H on BNB Smart Chain, causing the token’s price to plunge over 80% in a single day [2][3].

Key takeaways

• The breach stemmed from compromised private keys on a laptop, not a smart‑contract bug [3].
• Attackers drained 141.2 million H and minted 200 million new H, totaling 341 million tokens affected [2][3].
• The H token fell from $0.73 to below $0.08, an 89% drop, wiping out roughly $36 M in value [2].
• On‑chain analysis shows mixed evidence; some investigators note possible coordination, while others see the market‑maker activity as unrelated [1][2].
• Humanity Protocol halted bridge deposits and withdrawals and is working with security firms and exchanges to contain the damage [2][3].

Operational failure triggers cross‑chain theft

Humanity Protocol described the incident as an “operational security failure” rather than a vulnerability in its code. The attacker obtained three of six Gnosis Safe keys on Ethereum and three of five on BNB Chain, gaining ProxyAdmin control over the Hyperlane bridge [2][3]. With these privileges, they moved 141.2 million H from Ethereum wallets and minted a further 200 million H on BNB Smart Chain, flooding markets that could not absorb the volume [2][3]. The token’s market cap fell to $476 million, and trading volume spiked to $533 million in a single day, crushing liquidity pools [3].

Investigators debate motive and timing

Blockchain investigators initially questioned whether the exploit was linked to market‑maker or OTC activity ahead of an upcoming token unlock. ZachXBT later clarified that the market‑maker behavior appeared independent of the private‑key compromise [1][2]. Other analysts, such as Allium Labs’ Elton Shehdula, noted that the on‑chain pattern suggested a coordinated operation, with wallets funded weeks in advance and the minting authority “warmed up” days before the attack [1]. Cyvers senior security lead Hakan Unal emphasized that both genuine compromises and staged incidents can look similar when attackers hold legitimate admin rights, and the surrounding behavior—timing near unlocks, orderly movement—makes the case ambiguous [1].

Why it matters

The hack underscores the critical risk of key management in multi‑chain projects, especially those positioned as trusted identity layers. While Humanity Protocol’s zero‑knowledge and biometric technologies remained intact, the loss of admin keys exposed a structural vulnerability that allowed the creation of fresh tokens and massive fund drains [3]. The incident has prompted the project to suspend bridge activity, engage security firms, and cooperate with exchanges and law enforcement, but recovery of the stolen assets remains uncertain. For the broader and blockchain‑identity ecosystem, the episode highlights the need for robust operational security practices alongside cryptographic safeguards.