Humanity Protocol: One Infected Laptop, Seven Keys, $36M Gone

On 5 June 2026 an email reached Chong Yee Wai, a director of Humanity Protocol. It looked like a routine notice from Bithumb, a big South Korean crypto exchange, about a change to a token lock-up schedule. The attachment was malware. Once it was opened, the attackers had full remote control of the laptop. On that laptop, left over from the project's launch a year earlier, sat backups of seven private keys, the secret codes that act as signatures for moving the project's money.

Three days later, on 8 June, the attackers used them. By the next morning about 17 wallets linked to the project had been emptied, hundreds of millions of tokens had been taken or printed from nothing, and the project's H token had fallen about 90% in a day. The loss most outlets and the security firm Quantstamp settled on was about $36 million. Rekt News counted $36.4 million of stolen tokens sold through Uniswap, an automated trading venue.

Humanity Protocol sells a simple idea. It verifies that an online user is a real, unique human by scanning the palm of their hand, then issues a digital credential that proves it without revealing who the person is. CoinDesk described it as a rival to Worldcoin, the eyeball-scanning project co-founded by OpenAI's Sam Altman. The company, led by founder and chief executive Terence Kwok, had raised about $50 million from investors including Jump Crypto, Hex Trust and Kingsway Capital. Its H token traded on major exchanges and had hit a new high of about $0.67 on 1 June, a week before the attack.

How seven keys opened three doors

The project kept its money behind multisig wallets, Safe accounts that need several keyholders to sign, like a company bank account that needs two directors to approve a payment. On Ethereum the rule was three signatures out of six. On BNB Smart Chain, a second blockchain where H also traded, it was three out of five. The design is sound as long as the keyholders' keys are kept apart. Here, three Ethereum keys and three BNB keys sat on the same computer, alongside the key to an admin hot wallet, a wallet kept online for day-to-day use, like a cash drawer.

According to the project's own post-mortem, as reported by The Crypto Times and Rekt News, the attackers went through three doors.

First, they emptied the hot wallet of about 6 million H.

Second, they took over the Ethereum bridge. A bridge is the service that lets a token move between two blockchains, holding tokens on one side and releasing matching ones on the other, much like a currency exchange booth that keeps a till of both currencies. The bridge's code sat behind a ProxyAdmin, a master switch that lets its owners replace the code with a new version. With three of six keys, the attackers made themselves the owners, swapped in their own code and drained 141,182,632 H in a single transaction.

Third, on BNB Smart Chain, they seized the same kind of master switch over the H token itself and used it to mint new tokens, printing shares that no one had paid for. Humanity confirmed 300 million H minted in three batches. In total the project counted about 447 million H stolen or created without authorisation.

Selling into a falling market

The attackers sold as fast as the market would take it, swapping H for ether on decentralised exchanges, the automated trading venues that run without a company in the middle. Specter, an on-chain investigator who flagged the drain first, watched the reported losses go past $5 million and then past $20 million about 90 minutes later. H, which had been around $0.67, briefly touched $0.05 and settled near $0.13, according to CoinDesk. Ordinary holders, who had done nothing wrong, lost most of their money on paper within hours.

Timing made it worse. CoinDesk reported that about 266 million H, worth around $28 million before the crash, was due to unlock on 25 June across six allocations including the foundation's treasury. An unlock is the end of a lock-up period, like insiders being allowed to sell shares months after a stock market listing. Rekt News reported that more than 100 early investors were then offered a choice: take a 70% cut to get liquidity on 25 June, or accept a longer lock running to September 2026 and paid out quarterly over three years.

Staged, or just careless?

Within hours ZachXBT, one of crypto's best-known independent investigators, said the incident "seems possibly staged". He accused the team of pushing the token's price for weeks with no fundamentals behind it and demanded that it disclose its agreements with a Hong Kong market maker, a firm paid to keep a token trading, much like a designated market maker on a stock exchange. Elton Shehdula of the analytics firm Allium Labs pointed to attacker wallets funded weeks ahead and coordinated moves on both chains as signs of planning. The security firm PeckShield went further and called it a staged performance.

After tracing the laundering, ZachXBT revised his view: the suspicious market-making and the key theft, he said, appeared to be independent of each other. Humanity never publicly named the Hong Kong market maker. Kwok's explanation was the laptop. "What we believe happened was some of the keys were accidentally backed up to a compromised device," he told Cointelegraph.

On 14 June Quantstamp, the security firm that handled the incident response, linked the attack to North Korea. The malware was signed with a digital certificate from Hancom, a South Korean software company, which Quantstamp called "characteristic of DPRK intrusions". DPRK is the formal name of North Korea, whose state-backed hackers have stolen billions in crypto. The attribution rests on the certificate and the pattern of the attack, not on any identified person, and some researchers treated it with caution.

Starting the token again

On 16 June Humanity announced its recovery plan. It declared the old H token dead on Ethereum, BNB Smart Chain and its own Humanity Mainnet, and deployed a new, audited H token on Ethereum. Every holder at a snapshot taken at 17:25:35 UTC on 8 June, the last clean moment before the attack, would receive new tokens one for one. Addresses linked to the attackers were excluded, which in effect cancelled the stolen and minted tokens. Binance Alpha, MEXC, Bitget, KuCoin, Bybit and Gate converted balances for their customers. A compensation fund, with a claims portal requiring identity checks, was set up for cases the airdrop could not handle, such as people who bought after the snapshot.

The reset protected holders who had not sold. It did not undo the money the attackers had already taken out of the market: the ether they received for the stolen tokens came from real buyers. As of 16 October 2026 no funds had been publicly reported recovered, the $1 million bounty for information had produced no announced result, and nobody had been charged. The relaunch of Humanity Mainnet with the new H as its fuel, announced in June as weeks away, had not been confirmed by mid-October.