← Humanity Protocol H Token Hackreviewed 2026-10-17 · 14 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Humanity Protocol H Token Hack against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #5[disputed][awaiting moderator]in the timeline
“2026-06-16”
reviewerQuantstamp published findings attributing the attack tooling to DPRK-affiliated threat actors on 2026-06-16.The event description (Quantstamp/DPRK attribution) is accurate; the date field is wrong. It collides with the June 16 token-migration announcement (timeline entry 8), which is a separate, correctly-dated event — the Quantstamp report predates it by at least two days.Proposed correction (not yet applied)2026-06-14
link rot
2 claimsA cited source no longer resolves or no longer says what the page attributes to it.
- #7[link rot][awaiting moderator]in the timeline
“https://cryptomortem.com/event/humanity-protocol-hack-2026”
reviewerThe cryptomortem.com source for the June 5, 2026 phishing-email date is a live, reachable source.The underlying date claim (June 5 phishing email) is actually correct per Rekt's detailed timeline, but the cited source itself is currently dead and of unverifiable provenance, so the citation should be swapped rather than the date changed.Proposed correction (not yet applied)https://rekt.news/humanity-protocol-rekt - #8[link rot][awaiting moderator]in the cited sources
“https://www.cryptotimes.io/2026/06/16/humanity-protocol-unveils-h-token-recovery-and-airdrop-plan-post-36m-exploit/”
reviewerA cryptotimes.io article at the '-post-36m-exploit/' URL supports the recovery/airdrop plan details.Dead URL with an obvious live duplicate already present elsewhere on the page; a simple one-character-class fix (swap 'exploit' for 'hack' in the slug).Proposed correction (not yet applied)https://www.cryptotimes.io/2026/06/16/humanity-protocol-unveils-h-token-recovery-and-airdrop-plan-post-36m-hack/
partially supported
5 claimsThe cited evidence supports part of the claim but not all of it.
- #1[partially supported][awaiting moderator]in the summary
“On June 8-9, 2026, Humanity Protocol suffered a $36 million exploit when attackers compromised private keys stored on a malware-infected employee laptop, enabling them to drain approximately 141 million H tokens from an Ethereum bridge and mint an additional 300+ million tokens on BNB Smart Chain.”
reviewerOn June 8-9, 2026, Humanity Protocol suffered a $36M exploit draining ~141M H from the Ethereum bridge and minting 300+ million H on BSC.The headline figures match what Humanity Protocol itself disclosed and what most contemporaneous outlets reported, so this is not simply wrong — but it omits the later, more detailed on-chain forensic finding (QuillAudits, via Rekt) of substantially larger undisclosed minting on BSC. - #2[partially supported][awaiting moderator]in section: Financial Impact and Token Price Collapse
“The total unique impact of the exploit is estimated at approximately 447 million H tokens, comprising tokens stolen directly from bridge wallets and tokens minted without authorization on BNB Smart Chain.”
reviewerThe total unique impact of the exploit is approximately 447 million H tokens.The 447M figure itself is well-supported (matches Rekt's team-confirmed breakdown almost exactly), but the page presents it as the full 'total unique impact' without flagging that a named security firm's independent analysis found evidence of significantly more undisclosed minting. - #3[partially supported][awaiting moderator]in section: Attack Vector and Technical Details
“Using compromised three-of-five Gnosis Safe keys on BSC, the attacker gained ProxyAdmin control of the H token contract and minted approximately 100-300 million additional H tokens in separate transactions (figures vary by source between $12.9 million and approximately $36 million in total cross-chain impact).”
reviewerThe attacker minted approximately 100-300 million additional H tokens on BSC.Same underlying gap as the summary and Financial Impact claims: the page's range reflects early/official disclosure, not the fuller on-chain forensic picture. - #4[partially supported][awaiting moderator]in section: Incident Overview
“The exploit is classified as an operational security failure — no smart contract code vulnerabilities were involved.”
reviewerThe exploit is classified purely as an operational security failure with no smart contract code vulnerabilities involved.Most outlets (Halborn, CoinDesk, Quantstamp) do frame this primarily as a key-custody failure, which the page accurately reflects, but at least one named security firm identified a concrete smart-contract governance gap (missing timelock) that the page's blanket 'no smart contract code vulnerabilities were involved' does not acknowledge. - #6[partially supported][awaiting moderator]in section: Attribution: Suspected DPRK-Affiliated Threat Actors
“On-chain analyst Elton's earlier review of pre-exploit wallet activity noted that attacker wallets had been pre-funded weeks in advance using a combination of exchange withdrawals and mixer transactions in late April and May 2026, suggesting the attack was planned rather than opportunistic.”
reviewerOn-chain analyst Elton's earlier review found attacker wallets pre-funded weeks in advance using exchange withdrawals and mixer transactions in late April and May 2026.No search turned up an on-chain analyst named 'Elton' associated with this incident (the analyst widely cited for wallet tracking in this case is 'Specter'), and the only detailed pre-funding breakdown found (Allium/Rekt) covers late May only, not late April. The general claim that wallets were pre-funded in advance is supported; the specific attribution to 'Elton' and the 'late April' date range are not.
confirmed
6 claimsThe cited evidence supports the claim as written.
- #9[confirmed][no action needed]in section: Recovery Program and Token Migration
“The suspected DPRK attribution, if confirmed, would place this attack in a broader pattern in which North Korean state-sponsored actors were estimated to account for approximately 76% of crypto losses recorded in early 2026.”
reviewerNorth Korean state-sponsored actors were estimated to account for approximately 76% of crypto losses recorded in early 2026.Figure traces cleanly to TRM Labs data for Jan-April 2026, matching 'early 2026' as characterized by the page. - #10[confirmed][no action needed]in section: Attribution: Suspected DPRK-Affiliated Threat Actors
“No official government body had issued a formal public attribution as of the time of this investigation.”
reviewerNo official government body had issued a formal public attribution of the hack as of the time of this investigation.Consistent with all other reporting found: the DPRK link is attributed by a private security firm, not any government agency. - #11[confirmed][no action needed]in section: Attack Vector and Technical Details
“The compromised machine contained private keys for seven wallet accounts across Ethereum and BNB Smart Chain, including admin hot wallets and Gnosis Safe owner keys used to control the protocol's Hyperlane bridge.”
reviewerThe H token reached an all-time high of around $0.67 on June 1, 2026, and the compromised laptop contained private keys for seven wallet accounts.Precisely matches independent, detailed on-chain post-mortem reporting. - #12[confirmed][no action needed]in section: ZachXBT Investigation: Inside Job Claims and Subsequent Retraction
“However, after further analysis of fund flows, ZachXBT revised his position and concluded that 'the sketchy MM / OTC and private key compromise are independent of one another and not related,' effectively ruling out the staged hack hypothesis.”
reviewerZachXBT called the hack 'possibly staged' and later retracted, concluding the private-key compromise and suspicious MM activity were unrelated.Both the initial accusation and the retraction are independently corroborated by multiple outlets. - #13[confirmed][no action needed]in section: Recovery Program and Token Migration
“The team additionally established an H Compensation Fund for more complex edge cases, and announced a $1 million USDT bounty for information leading to recovery of stolen funds, with recovered assets committed to H token buybacks.”
reviewerHumanity Protocol established a $1 million USDT bounty and a claims portal at claim.humanity.org with identity verification requirements.Official source confirms the mechanics described; bounty figure is also independently reported. - #14[confirmed][no action needed]in section: Incident Overview
“Humanity Protocol is a decentralized identity project founded by Terence Kwok that uses palm-vein biometrics combined with zero-knowledge proofs to allow users to prove their humanity without revealing personal data.”
reviewerHumanity Protocol is a decentralized identity project founded by Terence Kwok.Consistently attributed across all sources checked.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.