Humanity Protocol has pointed fingers at North Korean-linked hackers for the theft of approximately $36 million in tokens. According to a June 13 security investigation by Quantstamp, attackers infiltrated a developer’s device infected with malware, gaining access to seven critical private keys stored inadvertently during the project’s mainnet launch in June 2025. The compromised keys included an admin hot wallet key, three Ethereum Safe owner keys, and three BNB Safe owner keys, allowing the attackers to control multiple production systems from a single machine.
The breach did not exploit any smart contract vulnerabilities but used valid credentials to authorize transfers, execute Safe transactions, and approve contract upgrades. The attacker siphoned roughly 141 million H tokens from the Ethereum bridge in one go, then minted additional tokens on BNB Smart Chain, eventually converting most of the proceeds into ETH. Humanity Protocol stressed that the bridge contracts, token contracts, and Safe architecture remained uncompromised—the theft resulted solely from stolen private keys.
Quantstamp linked the attack to North Korea-based threat actors based on tooling and certificate-signing activity. This incident caused the H token to plummet between 80% and 90% of its value after the disclosure. Although the token partially recovered, it was trading near $0.214 on June 13, still down about 74% from the previous week. Independent analysts like Lookonchain and ZachXBT confirmed the malware-related private key compromise as the root cause, while attribution to state-sponsored actors remains a topic of debate among some researchers.