Humanity Protocol Loses $32M in Major Security Breach; Token Value Plummets
Severity: High (Score: 66.2)
Sources: Pluang, Cryptopotato, Kucoin, Cryptobriefing, Decrypt.Co
Published: · Updated:
Keywords: humanity, protocol, token, nearly, after, major, worldcoin
Severity indicators: ot
Summary
On June 9, 2026, Humanity Protocol suffered a significant security breach, losing over $32 million due to compromised private keys linked to an employee's device. The attacker drained funds from at least 17 wallets, leading to a dramatic collapse of the H token's value, which fell nearly 90%. The breach was attributed to malware on a developer's machine, allowing the attacker to mint 100 million new H tokens on the BNB Smart Chain. The incident raised questions about the legitimacy of the breach, with on-chain investigator ZachXBT suggesting it may have been staged. Humanity Protocol's founder confirmed the breach and advised users to avoid interacting with affected systems. The attacker converted stolen assets into approximately 18,510 ETH and 1,548 BNB, with ongoing selling pressure from the newly minted tokens. The situation remains critical as the attacker still controls a significant amount of H tokens, posing a risk to price recovery. Key Points: • Humanity Protocol lost over $32 million due to a security breach on June 9, 2026. • A compromised employee laptop allowed the attacker to access private keys and mint new tokens. • The H token's value plummeted nearly 90%, raising concerns about potential insider involvement.
Detailed Analysis
**Impact** The breach affected Humanity Protocol, a blockchain-based identity verification platform valued over $1 billion, resulting in losses exceeding $32 million across at least 17 wallets tied to the project. The native H token’s value plummeted by approximately 80-90%, dropping from around $0.67-$0.78 to as low as $0.05-$0.13 within hours, severely impacting investors and token holders globally. The attacker converted stolen assets into roughly 18,510 ETH (~$30.8 million) and 1,548 BNB (~$924,000), creating significant market sell pressure and liquidity exhaustion. The incident disrupts the project’s operations and damages market confidence, with ongoing risks due to the attacker’s retained control over a large token supply. **Technical Details** The attack originated from a compromised developer machine infected with malware, granting the attacker root access and exposing multiple private keys, including admin hot wallet keys and Safe owner keys on Ethereum and BNB Smart Chain. The attacker exploited these credentials to drain wallets, mint approximately 300 million new H tokens on BNB Chain, and manipulate bridge infrastructure, including ProxyAdmin controls. No smart contract vulnerabilities or CVEs were exploited; the attacker used legitimate keys to authorize transactions, proxy upgrades, and token minting. The Ethereum H token was frozen post-incident, but the BSC token remains compromised and unrecoverable. **Recommended Response** Immediately freeze or restrict access to compromised wallets and ProxyAdmin controls where possible, prioritizing Ethereum token safeguards as BSC tokens are currently unrecoverable. Conduct a full forensic investigation of developer machines and infrastructure to identify and remove malware, and rotate all exposed private keys. Monitor blockchain activity for unusual minting or token transfers linked to attacker-controlled addresses and alert exchanges to prevent further liquidation of stolen assets. Enhance endpoint security and implement strict operational security protocols to prevent credential compromise.
Source articles (8)
- Humanity Protocol hacked, losing $30M and causi... | Pluang – Crypto, Stocks, Gold & Funds — Pluang · 2026-06-09
Humanity Protocol suffered a major security breach when attackers accessed private keys linked to a foundation member, resulting in losses of $32 million. The exploit led to aggressive selling of the… - Worldcoin Rival Humanity Protocol's Token Crashes 88% as $30M Wallet Drain Sparks ... — Cryptopotato · 2026-06-09
Humanity Protocol’s native token – H token – dramatically collapsed by nearly 88% on June 9 after falling from around $0.78 to nearly $0.099. The steep decline came after reports emerged of a major se… - ZachXBT Identifies Two Separate Events in Humanity's $31M Security Incident — Kucoin · 2026-06-09
BlockBeats report, June 9: On-chain detective ZachXBT has issued an update regarding today’s $31 million Humanity security incident. After further analysis of the fund movement pathways, ZachXBT belie… - Humanity Protocol Loses $32M in Private Key Hack as ZachXBT Calls Incident 'Possibly Staged' — News.Bitcoin · 2026-06-09
Humanity Protocol’s H token has crashed nearly 90% after wallets tied to the project were drained of more than $32 million, a breach onchain investigator ZachXBT says may have been “possibly staged.”… - Humanity Protocol hacker mints 100M $H tokens on BSC as selling pressure mounts — Cryptobriefing · 2026-06-09
A compromised employee laptop led to over $30 million in losses and an 80-90% collapse in the H token's price within hours. A hacker who breached the Humanity Protocol’s infrastructure has minted 100… - Humanity Protocol blames H token exploit on developer machine compromise — Cryptobriefing · 2026-06-09
Humanity Protocol said the H token exploit was caused by a developer machine compromised with malware, not a smart contract bug. Humanity Protocol said the exploit that hit its H token late Monday was… - Humanity Protocol Loses $36M After Private Keys 'Compromised,' Token Crashes 73% — Decrypt.Co · 2026-06-09
Humanity Protocol’s native token H collapsed more than 80% Tuesday after attackers compromised private keys tied to the project, seized bridge admin controls, and stole more than $36 million across Et… - “Decentralized Identity” Project Compromised by a Single Private Key - 深潮TechFlow — Techflowpost · 2026-06-09
TechFlow Intro: Humanity Protocol, a decentralized identity project, suffered a severe security incident today. The private key of a foundation member was compromised, resulting in the draining of ove…
Timeline
- 2026-06-09 — Humanity Protocol security breach reported: Over $32 million was drained from 17 wallets due to compromised private keys, causing H token value to drop nearly 90%.
- 2026-06-09 — H token minting and selling begins: The attacker minted 100 million H tokens on BNB Smart Chain, converting stolen assets into ETH and BNB.
- 2026-06-09 — Humanity Protocol confirms breach cause: The breach was attributed to malware on a developer's machine, exposing multiple private keys.
- 2026-06-09 — ZachXBT questions legitimacy of the breach: On-chain investigator ZachXBT suggested the incident may have been staged, calling for transparency from Humanity Protocol.
Related entities
- Data Breach (Attack Type)
- Malware (Attack Type)
- Humanity Foundation (Company)
- Humanity Protocol (Company)
- Arbitrum (Company)
- Binance (Company)
- Bybit (Company)
- Ethereum (Company)
- Gnosis Safe (Company)
- North Korea (Country)
- bitcoin.com (Domain)
- chain.in (Domain)
- BNB Chain (Platform)
- BNB Smart Chain (Platform)
- Gate (Platform)
- Kyber Network (Platform)
- PancakeSwap (Platform)