Humanity Protocol Confirms $36M H Token Theft Across Ethereum and BSC

TLDR

• Humanity Protocol said over $36M in H tokens was stolen across Ethereum and BNB Chain.
• H token fell more than 80% after the June 8 bridge attack.
• Three of six Ethereum Gnosis Safe owner keys were compromised.
• The attacker swept about 141.2M H tokens in one Ethereum transaction.
• Humanity Protocol halted deposits and withdrawals on affected bridges.

Humanity Protocol’s H token fell more than 80% after the project said a coordinated attack across Ethereum and BNB Chain led to more than $36 million in stolen tokens and forced the suspension of affected bridge activity.

The decentralized identity project said the incident occurred on June 8 after an employee’s laptop was compromised. Attackers gained access to multiple Gnosis Safe owner keys, seized control of bridge administration contracts, upgraded them to malicious implementations, and moved large amounts of H tokens.

The project said it has halted deposits and withdrawals for the affected bridges while working with exchanges, related parties, security teams, and police. Humanity Protocol also said it plans to publish a detailed post-mortem after its internal investigation advances.

H Token Falls More Than 80% After Attack

The H token dropped sharply after the breach became public, falling from about $0.67 to near $0.13 and briefly touching $0.05 during the selloff. That move represented an intraday decline of about 90% at the lowest point, before the token recovered part of the loss.

Humanity Protocol said more than $36 million had been stolen across Ethereum and BNB Chain. Earlier on-chain assessments placed losses above $32 million, with at least 17 wallets affected. The project later said the stolen amount had exceeded $36 million as the investigation continued.

The attacker sold stolen H tokens for ether, creating heavy market pressure during the decline. Blockchain data also showed additional H tokens were minted on BNB Chain, adding to concerns about further selling.

Humanity Protocol urged users to avoid the affected bridges and liquidity pools while it works to contain the incident. The project said deposits and withdrawals have been halted on impacted bridges, and that it is coordinating with exchanges in an effort to reduce further damage.

Compromised Keys Allowed Bridge Takeover

Humanity Protocol said the attack involved compromised owner keys controlling bridge administration systems. On Ethereum, three of six Gnosis Safe owner keys tied to the Hyperlane bridge ProxyAdmin were compromised.

The attacker used those keys to transfer ProxyAdmin ownership to a wallet under their control. After gaining administrative control, the attacker upgraded the bridge contract to a malicious implementation and swept about 141.2 million H tokens in a single transaction.

A similar action occurred on BNB Chain. Humanity Protocol said three of five BSC Safe owner keys were compromised. The attacker used those keys to take over the ProxyAdmin on BSC, deployed a malicious implementation with an unlimited mint function, and minted 200,000,005 H tokens in two tranches directly to the attacker’s wallet.

The project said the breach followed the compromise of an employee laptop. Founder Terence Kwok also said attackers had obtained private keys linked to a member of the Humanity Foundation.

The incident shows how administrative key compromise can affect token bridges and related infrastructure. In this case, the attacker did not need to exploit normal user transactions. Instead, control over privileged keys allowed the attacker to change contract logic and move or mint tokens.

Humanity Works With Exchanges and Police

Humanity Protocol said it is working with related parties, including exchanges, to reduce damage from the stolen and minted H tokens. The project also said it is working with police to investigate the breach and attempt to recover some of the funds.

The team apologized to users and said it would continue providing updates to the community. It also said it remains committed to building the protocol and will release a full post-mortem on the incident.

Humanity Protocol is a decentralized identity project that uses palm-scan biometrics and zero-knowledge cryptography to help users prove they are human without publicly exposing personal information. The project is positioned as a competitor to Worldcoin, another identity-focused crypto project tied to biometric verification.

The breach comes ahead of a scheduled H token unlock. About 266 million H tokens, valued at roughly $28 million based on cited market levels, are set to unlock on June 25 across six allocations, including the foundation treasury and strategic reserve.

Humanity Protocol previously raised $50 million from 27 investors, including Jump Crypto, Hex Trust, and Kingsway Capital. The attack adds pressure to the project as it works to restore confidence, secure affected infrastructure, and coordinate with exchanges over stolen token flows.

The H token was recently trading near $0.13, down about 82% on the day. Users are still being advised to avoid the impacted bridge and liquidity systems until Humanity Protocol confirms that the issue has been contained.

The post Humanity Protocol Confirms $36M H Token Theft Across Ethereum and BSC appeared first on CoinCentral.