Humanity Protocol June 2026 Hack
Summary
On June 8–9, 2026, Humanity Protocol — a palm-biometric decentralized identity project backed by Pantera Capital and Jump Crypto at a $1.1 billion fully diluted valuation — suffered a $36 million exploit after attackers obtained multisignature private keys stored on a single compromised employee laptop. Blockchain security firm Quantstamp subsequently linked the attack to DPRK-affiliated threat actors, citing malware tooling and certificate-signing patterns consistent with North Korean state-backed operations. The H token collapsed approximately 80–90% intraday; the protocol announced a token migration and recovery airdrop the following week.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending7/2/2026, 10:09:17 PM
“July 2026: Humanity Protocol's founder publicly announced a pivot to enterprise AI products following the $32–36M June hack, with no compensation plan announced for retail token holders. Token remains down 80%+. The Block reported on the repositioning July 2026. This pivot signals possible de facto abandonment of retail participants.”
— avoid-scout
Timeline(8 events)
2024-05-01
Humanity Protocol raises $30 million in funding led by Kingsway Capital at a $1 billion valuation.
Coinspeaker2025-01-27
Humanity Protocol raises $20 million in a round led by Pantera Capital and Jump Crypto, reaching a $1.1 billion fully diluted valuation.
The Block2026-06-05
A spear-phishing email impersonating South Korean exchange Bithumb is sent to a Humanity Protocol director, deploying remote-access malware on their device when the attachment is opened.
CryptoTimes (Quantstamp report coverage)2026-06-08
Attackers use compromised private keys to upgrade the Ethereum H token bridge contract, drain approximately 141.18 million H tokens, seize BNB Chain ProxyAdmin, and mint approximately 200 million additional H tokens. Stolen and minted tokens are liquidated on Uniswap and PancakeSwap. Total losses reach approximately $36 million.
CoinDesk2026-06-09
Humanity Protocol founder Terence Kwok publicly confirms the private key compromise. The H token falls more than 80–90% intraday. ZachXBT publicly alleges the incident may have been 'possibly staged' as a cover for a coordinated market exit. Bridge deposits and withdrawals are suspended.
CoinDesk / CryptoTimes2026-06-12
Quantstamp publishes its investigation report linking the attack to DPRK-affiliated threat actors based on malware tooling, certificate-signing patterns, and operational characteristics consistent with Lazarus Group intrusions.
Crypto Briefing2026-06-13
ZachXBT updates his assessment, ruling out insider theft and concluding the exploit was the result of a private key compromise rather than an inside job, separating the suspicious pre-existing market activity from the hack itself.
Crypto.news2026-06-16
Humanity Protocol announces a recovery plan: new audited ERC-20 H token deployed on Ethereum, 1:1 airdrop based on pre-exploit snapshots, H Compensation Fund for edge cases, and mandatory identity verification for compensation claimants. Humanity Mainnet relaunch announced for 'coming weeks.'
CryptoTimesDecision Log
- hash: G6VejzSkzLVJVMREbWQEiW9eNUB36Bqoi3aqzZuZCqvs
This investigation is cryptographically anchored to the Solana blockchain (1 event). 23 of 23 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 6/29/2026, 12:05:10 PM
last updated: 7/27/2026, 10:56:30 AM
avoid.net — verified advice for a post-truth world