Humanity Protocol exploit analysis

Humanity Protocol, a decentralized-identity network built around palm-scan proofs of personhood, lost roughly $36 million on June 9, 2026 after malware on a single employee laptop gave the attacker control over the bridge admin keys for both Ethereum and BNB Chain. The CoinDesk report described a fundamental lapse in how the multisig had been set up: four individuals had been issued them, but several had been backed up to the same device, so a compromise of one laptop satisfied the multisig threshold on its own.

How the keys were used

The attacker obtained three of the six keys controlling the bridge's admin account on Ethereum and three of the five on BNB Chain. They transferred ownership to their own wallet, swapped the bridge's code for a malicious version, and drained about 141 million H in one transaction. They then upgraded the bridge and minted 300 million new H tokens. The H token price fell 80 to 90 percent as the attacker swapped the proceeds into ETH. Halborn's technical write-up notes that several private keys had been stored in a backup on the infected device, which is the underlying cause of the multisig being effectively single-party.

Laundering and follow-up

Funds were observed moving through KuCoin in the days after the exploit. ZachXBT later ruled out insider theft but identified a connection between this incident and a separate exploit on Kelp DAO, pointing to a common operator. Humanity Protocol halted bridge deposits and withdrawals, engaged law enforcement, and worked with centralized exchanges to flag incoming funds.

Where it sits in the corpus

Single-machine key custody was the dominant pattern in mid-2026 bridge losses. The Gravity Bridge exploit three weeks earlier was attributed to a compromised validator signing key. The Taiko bridge exploit a few weeks after this one traced back to a key that had been exposed on GitHub. Three large incidents, three different operator-side failures. The contracts were not the weak point in any of them.