What happened
On June 8, 2026, an attacker used stolen production keys to take control of Humanity Protocol's H token bridges on Ethereum and BNB Chain. The keys came from a single developer's Windows machine, which was infected through a spear-phishing email posing as Bithumb. About a year earlier, seven keys had been backed up to that machine by mistake, including three of the six Ethereum Safe signers and three of the five BNB Chain Safe signers.
That was enough to meet both multisig thresholds. The attacker drained about 147M H on Ethereum, minted at least 300M H on BNB Chain, and sold H through Uniswap for about $36.4M as the token fell 80-90%. Humanity halted its bridges, offered a $1M USDT bounty, deployed a new audited ERC-20 on Ethereum, and airdropped it to holders from a June 8 17:25:35 UTC snapshot.
Quantstamp forensics said the malware delivery resembled DPRK intrusions. PeckShield questioned whether the event was staged, and ZachXBT disagreed.
How it happened
- A spear-phishing email impersonating Bithumb delivered malware to a developer's Windows machine, which held backed-up copies of seven production keys. The attacker later gained remote access.
- Using a stolen hot-wallet key, the attacker sent 6,045,060 H to an address it controlled on Ethereum.
- With three of the six Ethereum Safe keys, it signed offline, took ownership of the bridge
ProxyAdmin, upgraded the bridge to a malicious implementation and swept 141,182,632 H in one transaction. - With three of the five BNB Chain Safe keys, it seized the
ProxyAdminthere, installed an implementation with unrestricted minting and minted H to its own wallets. - It sold H for ETH through Uniswap, realizing about $36.4M, and consolidated the proceeds across a cluster of addresses.
Protocol details
Evidence
- report @Humanityprot incident report x.com
- report @PeckShieldAlert incident report x.com
- report @CertiKAlert incident report x.com
- report Humanity Protocol - Rekt rekt.news
- analysis DeFiLlama defillama.com
- analysis Humanity's $36 million exploit happened because a 'multisig' lived on one laptop coindesk.com
- analysis Explained: The Humanity Protocol Hack (June 2026) halborn.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
