Humanity Protocol has reported a security breach resulting in the theft of over $36 million worth of H tokens. The exploit occurred after attackers gained unauthorized access to administrative keys for the protocol’s bridge infrastructure on Ethereum and BNB Smart Chain.
According to the project’s June 9 update, the attack began when a compromised employee laptop allowed the hacker to obtain control over bridge administration systems. Using three of six compromised Gnosis Safe owner keys for the Ethereum bridge’s Hyperlane ProxyAdmin, the attacker transferred ownership to their wallet, upgraded the contract to a malicious version, and moved approximately 141.2 million H tokens in one transaction.
On BNB Smart Chain, the attacker similarly took over three of five Safe owner keys, enabling them to deploy a contract with an unlimited mint function and create 200 million H tokens across two transactions. On-chain analyst Specter initially reported losses near $19 million, but later tracking raised the figure above $30 million, with roughly $23.7 million swapped for Ethereum and $7.9 million remaining in H tokens.
Humanity Protocol has suspended deposits and withdrawals on affected bridges and is coordinating with exchanges and law enforcement to investigate and recover funds. CEO Terence Kwok stated the team is working with security specialists but has not announced a reimbursement plan. The protocol’s native token plummeted over 90% in market reaction. Humanity Protocol operates a zkEVM-based identity network using zero-knowledge proofs and palm biometrics for verification.