Humanity Protocol engaged Quantstamp on 8 June 2026 after the $H token was minted and sold without authorization on Ethereum and BNB Smart Chain (BSC). We reconstructed the on-chain activity and examined the two devices belonging to Mr Chong Yee Wai, a director of the issuer, whose keys the attacker stole and used. This is our summary of findings to date.
2. What happened on-chain
The attacker ran a coordinated operation across both chains on 8 June 2026. Everything below is on-chain and verifiable by transaction hash.
● Ethereum: using Mr Chong's stolen account key (0xe943dbD064Ec283bDc95c39FaEE6184E9D26d026), the attacker replaced the implementation of a Hyperlane warp-route proxy and moved 141.18 million $H to 0xd1ea823d421e0c829ee11f772af487fd352678ea.
● BSC: using his three stolen Safe signer keys, the attacker took ownership of a ProxyAdmin contract (0xd73cd1117646625ffe23a55860035ac62fa8720d) via Safe transaction 0xb5cb1f2e0e246fcdde9ddaa7f36037341948158f4c4a0c3ec6fea121cbf0194b, then minted 100 million new $H to a new address (0x6Aa22CB8420E94Fc2119364b4c7885710aE753bB).
● The attacker sold the $H on Uniswap and PancakeSwap over roughly eight hours for ETH and BNB, crashing the open-market $H price by 89% and hitting liquidity providers and remaining holders.
● Proceeds at known attacker addresses already exceed USD 21 million in ETH; BNB proceeds are still being tallied.
The Ethereum account and BSC Safe are Humanity Protocol's own assets, used by the attacker with stolen keys — as were roughly 150 operational $H wallets and the wallet that funded their gas, all of which the attacker drained (see Section 4).
3. How the attacker got in
The attacker phished Mr Chong, installed remote-access malware on his Windows machine, and stole the keys used on-chain. Mr Chong has confirmed the user actions below.
3.1 The phishing email
Mr Chong received an email impersonating the Korean exchange Bithumb a circulating-supply lockup schedule, with a malicious attachment, Bithumb_Circulating_Supply_Lockup_Schedule.zip. The link pointed to an attacker-controlled host (celuweb.com).
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
