Analysis of the 36 Million Dollar Key Management Incident at Humanity Protocol

Incident Overview

On June 8, 2026, Humanity Protocol suffered a $36 million hack. An attacker compromised private keys belonging to one member of the Humanity Foundation. Using these keys, the attacker reached the signing threshold on two multisigs, upgraded the Ethereum bridge contract to enable a token sweep, and minted new H tokens on BNB Chain. The H token plummeted by up to 90% the following day.

The breach was not caused by any smart contract vulnerability. It resulted from years of accumulated shortcuts in how the foundation managed its administrative private keys.

Background

Humanity Protocol is a decentralized identity system built on palm biometrics and zero-knowledge proofs. Users scan their palms to generate a unique human identifier. These proofs allow people to verify they are real humans without revealing raw biometric data. Projects use the system to reduce Sybil attacks in token launches, airdrops, and governance votes.

The protocol issues an H token traded on Ethereum and BNB Chain. A bridge contract moves value between the two networks and holds H reserves. Administrative actions on the bridge and token contract require approval from multisignature wallets:

• Ethereum bridge: 3-of-6 multisig
• BNB Chain (ProxyAdmin): 3-of-5 multisig

These setups were intended to distribute power and prevent any single party from unilaterally changing contract logic.

In practice, the foundation assigned three keys from each multisig to the same individual, and all keys were stored on one single laptop. This turned the multisigs into a single point of failure once the device was compromised.

Preparation & Initial Compromise

The foundation member kept the keys on a personal laptop instead of using dedicated hardware wallets or air-gapped machines. The same person controlled enough keys to meet both multisig thresholds without needing any other signers. Security practices on the laptop fell far below the standards expected for managing tens of millions of dollars in assets.

The compromise occurred around June 5, 2026. The attacker sent a phishing email impersonating the South Korean exchange Bithumb, containing a malicious ZIP attachment. Opening the file installed remote access malware, giving the attacker control of the laptop.

Subsequent analysis by Quantstamp linked the tools and techniques to North Korean (DPRK) threat actors. After gaining access, the attacker waited patiently until large token reserves had accumulated in the bridge before launching the attack.

Blockchain investigator ZachXBT publicly ruled out any insider collusion from the core team.

Attack Execution

With control over sufficient keys on both chains, the attacker moved quickly.

On Ethereum, the attacker used the three compromised keys to submit an upgrade transaction for the bridge contract. The new implementation included a sweep function that bypassed normal withdrawal limits, draining approximately 141.2 million H from the bridge.

Simultaneously on BNB Chain, the attacker used the three compromised ProxyAdmin multisig keys to upgrade the token contract or adjust minting permissions, minting roughly 200 million additional H tokens. The attacker consolidated both batches and transferred them out of reach.

The entire operation took place within a short window on June 8. In total, the attacker obtained approximately 347 million H, valued at around $36 million at the time.

// Simplified representation of the upgrade + sweep pattern
function upgradeBridge(address newImpl) public onlyMultisig {
 _upgradeTo(newImpl); // New implementation contains sweep function
}
function sweepTokens(address token) public onlyOwnerAfterUpgrade {
 IERC20(token).transfer(attacker, IERC20(token).balanceOf(address(this)));
}

Root Cause

The root cause lay in governance and key management, not in the code itself. One individual held three keys in the Ethereum 3-of-6 multisig and three keys in the BNB Chain 3-of-5 multisig, with all keys stored on a single inadequately protected laptop.

Multisig security assumes independent key holders and separate storage. When those assumptions are broken, the security guarantees collapse. The foundation had never conducted an independent audit of key distribution or storage locations. This oversight turned a routine device compromise into a protocol-level theft.

Market Confidence Shaken After H Token Exploit

An exploit targeting the H token ecosystem resulted in the theft of 141.2 million H from the Ethereum bridge and the unauthorized minting of approximately 200 million H on BNB Chain. The attacker routed the proceeds through multiple intermediary wallets before moving them out of public view, with no further activity observed on protocol-linked DEXs. The incident triggered a sharp market reaction: the H token plunged by nearly 90% within 24 hours, erasing more than $1 billion from its market capitalization. Project maintainers immediately advised users to avoid the compromised bridge and any related liquidity pools. Although no other protocols suffered direct bad debt, the breach significantly eroded confidence in decentralized identity projects, leading several exchanges to temporarily suspend H token trading.

Investigators Trace the Breach to North Korean Tactics

After the incident, the team issued an official statement acknowledging the compromise, suspending bridge operations, and committing to transparency. A one-million USDT bounty was offered for credible information leading to the recovery of stolen assets. Law enforcement and leading blockchain security firms were brought in to investigate, with Quantstamp releasing an independent review around June 12 that identified techniques consistent with activity linked to North Korean threat groups. The team later announced a token migration plan, promising a one-to-one airdrop of new H tokens that would exclude the attacker’s addresses. Bridge services remain paused as strengthened multi-signature setups and enhanced wallet security measures are deployed.

Poor Wallet Management Hurts Longer Than the Hack Itself

The breach highlighted that multi-signature wallets cannot provide true resilience when key holders are not genuinely independent or when keys are stored in a centralized way. This lesson is not new. In the 2022 Ronin Bridge hack, attackers were able to steal approximately 620 million dollars after compromising five out of nine validator keys, four of which were controlled by the same organization, Sky Mavis, and stored without adequate separation. A similar pattern emerged in the 2025 Bybit incident, where more than 1.5 billion dollars was taken following the compromise of a multisig cold wallet through direct device access and manipulation of the user interface. These events demonstrated once again that centralized key custody removes the intended benefits of multi-party approval. When several keys are controlled by a single person or kept on the same device, the security model collapses into a single point of failure. Strong wallet management practices require each signing key to be held by a different individual with no overlap in custody, ideally spread across multiple geographic regions to reduce correlated risks. Keys should be stored on secure, dedicated hardware, preferably kept completely offline, and guarded with strong passphrases and multiple layers of authentication. Independent security audits should be conducted on a regular basis, complemented by drills that simulate key loss or compromise scenarios to ensure the ability to respond quickly. The majority of treasury funds should remain in cold storage, and the amount kept in hot wallets should be limited to operational needs. Organizations must follow a disciplined approach to rotating and revoking keys and maintain documented operational policies that build trust within the community. Responsibilities should be clearly separated so that no one individual has control over multiple critical wallet systems. Continuous education and heightened security awareness for all participants are also essential, since human error and social engineering remain among the most effective tools used by attackers. Groups linked to North Korea have repeatedly taken advantage of these weaknesses in high-profile cases. Ultimately, fostering a culture where signers feel empowered to challenge suspicious requests and take immediate action in emergencies is just as important as the strength of the hardware and cryptography protecting the assets.