Humanity Protocol, a decentralized identity project, has revealed how attackers stole over $36 million worth of its H token. The breach, detailed in an update shared with CoinDesk, stemmed from a serious security failure in how it managed its private keys.
According to Humanity, the incident began when an employee’s laptop was compromised. That machine held several keys controlling the project’s token bridges, which are tools that move H and other tokens between blockchains. These bridges operated through multisignature wallets, a setup that typically requires multiple separate keys from different people or devices to approve any change. But in this case, all the keys were stored on a single device.
How the Theft Unfolded
The attacker managed to obtain three of the six keys controlling the bridge’s admin account on Ethereum. That was enough to take control of the project’s deployment on that network. The exploiter then transferred ownership to their own wallet, swapped the bridge’s code for a malicious version, and drained about 141 million H in one transaction.
The same pattern was repeated on BNB Chain, using three of five keys. This time, the attacker installed code with an unlimited mint function, allowing them to create tokens at will. They minted roughly 200 million new H straight to their wallet.
Humanity founder Terence Kwok told CoinDesk in a Telegram message that the team had set up a multisig wallet across four individuals, as it should have. But he suspects that “some of the keys were accidentally backed up to a compromised device during setup.”
“We use a licensed custodian for the majority of token treasury, mpc for operations treasury, and for certain contracts multisig keys were set up in one place and then dispersed,” Kwok said. “Unfortunately in this scenario, the keys were backed up on a compromised device.”
Aftermath and Token Price Impact
Humanity has since removed the team page from its website. The project said it has halted deposits and withdrawals on the affected bridges and is working with exchanges and the police to recover funds. Humanity raised $20 million from Pantera Capital and Jump Crypto last year at a $1.1 billion valuation.
Prominent onchain investigator ZachXBT noted that the key compromise and a separate round of suspicious market-making in the token were not connected. He also raised questions about how the token traded in the weeks before the breach, ahead of a large scheduled token unlock. H token prices shot up from 20 cents to 70 cents within two weeks.
The token has clawed back some ground since the attack. After falling as low as about 5 cents, it recovered to around 20 cents, according to CoinGecko data. That’s still well below the roughly pre-breach level of 67 cents.
