Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys
Humanity Protocol (H token) bridges and treasury
On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools.
Why this severity: $36M reported stolen, only partly contained.
- Started
- Jun 8, 2026
- Closed
- Jun 15, 2026
- Reported stolen
- $36M
At risk
- Humanity Protocol (H token) bridges and treasury
- Ethereum wallets
- BNB Chain wallets
What to do now
- Don't use the bridge or H pools until the team confirms they are safe.
- Beware of fake 'refund' or 'token migration' sites; use only links from official channels.
Stay safe
Am I affected?
If you hold H tokens or used Humanity Protocol's bridges or H liquidity pools around 8 June 2026.
What to do now
- Don't use the bridge or H pools until the team confirms they are safe.
- Beware of fake 'refund' or 'token migration' sites; use only links from official channels.
How to avoid this
- For teams: never back up signing keys onto developer machines, give each multisig signer a separate hardware wallet, and put timelocks on bridge upgrades.
- For holders: check who controls a token's bridge and upgrade keys before holding large amounts.
Timeline 3
Halborn's analysis said malware with root access on a developer computer collected seven keys left there by an accidental backup at mainnet launch; ZachXBT questioned that explanation.
SourceFounder Terence Kwok confirmed the incident; the team halted deposits and withdrawals on the affected bridges as H fell from $0.731 to $0.0796.
SourceAttackers used stolen keys to take over Safe multisigs on Ethereum (3 of 6) and BSC (3 of 5), gained ProxyAdmin control and drained about 141.2M H.
Source
News & write-ups ›2
How this method works
A private key or seed phrase ends up somewhere readable: code on GitHub, an env file, a hacked server or cloud notes. Bots find it within minutes. Read about leaked private keys and seed phrases →
Follow new drains and updates in your feed reader or Telegram RSS bot.