Humanity Protocol Hack

On June 9, 2026, the identity-focused network Humanity Protocol suffered a devastating administrative breach resulting in financial losses exceeding $31 million. A targeted private key leakage compromised multiple linked ecosystem wallets and the protocol's core token admin multisig.

The catastrophe unfolded due to an operational security failure where the private keys of a prominent Humanity Foundation member, along with all three signer keys of an underlying token admin multisig wallet, were entirely compromised.

With top-level multi-sig access achieved, the attacker immediately altered the network's trust infrastructure. First, they target-drained roughly 187.6 million $H tokens by compromising over 280 connected ecosystem wallets that held active allowances or direct association with the compromised credentials. Second, the hacker executed a malicious proxy contract upgrade by altering the target implementation behind the token admin deployment on the BNB Chain. This enabled them to mint 100 million completely unbacked $H tokens out of thin air. The stolen and freshly minted assets were aggressively dumped across six major consolidation addresses into decentralized and centralized liquidity pools. The attacker extracted approximately 16,320 ETH ($27.5 million) and 2,700 BNB ($1.6 million) before the team could intervene and halt the primary bridge architectures.

Attacker Consolidation Addresses:

0x456cb73b…984aef

0xee4b6b89…c566f7

0xaf2a4989…aad3a0

0x1dfe5cf3…3f844a

0xd1ea823d…2678ea

0x9e995952…150504