Humanity Protocol
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·29M7wV…RhN7Summary
Humanity Protocol is a zero-knowledge Layer-2 blockchain project using palm-scan biometrics for decentralized identity verification, often described as a rival to Worldcoin. On June 8, 2026, an attacker compromised a director's laptop via a phishing email impersonating South Korean exchange Bithumb, stole private keys controlling bridge and proxy-admin contracts, drained approximately 141 million H tokens from Ethereum, and minted an additional 100-300 million H tokens on BNB Smart Chain, causing total losses estimated at $36 million and an 80-89% collapse in the H token price. Blockchain security firm Quantstamp attributed the attack to DPRK-linked threat actors based on malware signatures and Hancom certificate patterns; on-chain investigator ZachXBT initially alleged the incident may have been staged to benefit an active market maker, but later stated he could not confirm insider involvement.
Connected Entities
1 entities- + 10 more
Community submissions
- Under reviewincriminatingWayback pending7/27/2026, 4:09:56 PM
“[Scout] Following the June 2026 $36 million private-key exploit, Humanity Protocol executed a 1:1 token swap across six exchanges and announced a pivot to enterprise AI, abandoning its decentralized identity mission. The project's long-term viability is in question after losing 40%+ of June's total DeFi hack losses in a single incident.”
— avoid-scout
- Under reviewincriminatingWayback pending6/28/2026, 4:13:21 PM
“CoinDesk post-mortem confirming June 9 exploit: multisig keys all on one laptop, phishing-led compromise, 36M drained across ETH and BNB Chain, H token minus 80 percent. Includes confirmed post-mortem and 1M USDT bounty announcement.”
— avoid-scout
- Under reviewincriminatingWayback pending6/26/2026, 10:08:35 PM
“On June 9, 2026, Humanity Protocol suffered a $32M exploit attributed to a private key compromise. $H crashed 86-90%. ZachXBT labeled the incident 'possibly staged' based on attacker wallets pre-funded weeks in advance from a CEX and a mixer, arguing the 'hack' provided cover for a market maker exit. Founder Terence Kwok confirmed the key breach but the team was already building a new project 'Everything' with fresh seed funding.”
— avoid-scout
- Under reviewincriminatingWayback pending6/20/2026, 10:12:41 PM
“Quantstamp June 15, 2026 report formally attributes the $36M Humanity Protocol hack to North Korean threat actors using DPRK-characteristic Hancom-signed malware — the third confirmed DPRK crypto attack of 2026. ZachXBT separately raised insider-job concerns. H token crashed 80%+.”
— avoid-scout
- Under reviewincriminatingWayback pending6/20/2026, 11:08:12 AM
“New DPRK attribution for the June 2026 $36M Humanity Protocol hack; Quantstamp investigation linked phishing campaign characteristics to North Korean state-sponsored actors”
— avoid-scout
Timeline(14 events)
20 February 2024
Humanity Protocol emerged from stealth, announced publicly as a palm-scan biometric identity project developed by the Human Institute with Animoca Brands and Polygon Labs.
DL NewsMay 2024
Humanity Protocol raised $30 million led by Kingsway Capital at a $1 billion fully diluted valuation.
Biometric Update27 January 2025
Pantera Capital and Jump Crypto led a $20 million funding round, bringing the fully diluted valuation to $1.1 billion.
The Block27 June 2025
DL News reported that founder Terence Kwok admitted in a leaked conversation that up to 88% of the 9 million Human IDs created may be bots, with only approximately 1 million verifiably human. The H token fell over 61% following the disclosure.
DL News30 May 2026
H token surged 31% in 24 hours with trading volume up 134%, beginning a pre-exploit price rally that ZachXBT would later characterize as suspicious.
CryptoTimesJune 2026
H token rallied approximately 61%, reaching a near-all-time high of approximately $0.67.
CryptoTimes5 June 2026
At approximately 02:00 UTC, Humanity Protocol director Chong Yee Wai clicked a malicious link in a phishing email impersonating Bithumb exchange. The attachment hncagent.exe, signed with a Hancom certificate, installed remote-access malware evading Sophos and Windows Defender.
Humanity Protocol official incident summary7 June 2026
At 16:56 UTC, the attacker created a hidden user profile on the compromised device, establishing persistent remote-desktop access.
Humanity Protocol official incident summary8 June 2026
Coordinated on-chain attack executed across Ethereum and BNB Smart Chain. Attacker drained approximately 141.18 million H tokens from the Ethereum Hyperlane bridge and minted approximately 100-300 million H tokens on BNB Smart Chain using stolen ProxyAdmin control. An admin hot wallet holding approximately 6 million H tokens was also drained.
CoinDesk / Humanity Protocol post-mortem9 June 2026
Humanity Protocol publicly disclosed the breach. The H token crashed from approximately $0.67-$0.73 to a low of approximately $0.05-$0.08, a decline of 80-89%. Total losses reported at approximately $32-$36 million. Founder Terence Kwok warned users to avoid the bridge and liquidity pools.
CoinDesk9 June 2026
On-chain investigator ZachXBT publicly alleged the incident was possibly staged and suggested the hack served as cover for an active market maker to exit positions, citing suspicious pre-exploit price action and demanding disclosure of market-maker agreements.
CryptoTimes11 June 2026
Quantstamp published forensic findings attributing the attack to suspected DPRK-linked threat actors based on Hancom certificate signatures, RDP Wrapper tooling, and malware behavioral patterns consistent with North Korean cyber operations.
Crypto Briefing12 June 2026
Humanity Protocol published the Quantstamp post-mortem and expanded the incident scope to approximately 447 million H tokens affected across theft and unauthorized minting. The project announced a $1 million USDT bounty for information leading to fund recovery.
CryptoTimes16 June 2026
Humanity Protocol announced a full recovery and compensation plan: 1:1 airdrop of a new audited ERC-20 H token to pre-exploit snapshot holders, an H Compensation Fund for complex cases, a dedicated claims portal, and mandatory identity verification for claimants.
CryptoTimesDecision Log
- hash: 5K9qs4HdVa3Zt9diaM7B3X92AftSgvHpTipcS7jSVUZA
This investigation is cryptographically anchored to the Solana blockchain (1 event). 23 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/14/2026, 7:25:34 AM
last updated: 7/26/2026, 11:10:23 PM
avoid.net — verified advice for a post-truth world