{
 "slug": "humanity-protocol-dev-machine-keys-jun-2026",
 "title": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
 "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026",
 "json": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "ethereum",
  "bsc"
 ],
 "method": "key-leak",
 "product": "Humanity Protocol (H token) bridges and treasury",
 "tags": [
  "ethereum",
  "bsc",
  "key-leak",
  "humanity-protocol",
  "malware",
  "infostealer",
  "developer-machine",
  "gnosis-safe",
  "multisig",
  "bridge",
  "h-token"
 ],
 "amountUsd": 36000000,
 "victims": null,
 "startedAt": "2026-06-08",
 "closedAt": "2026-06-15",
 "updatedAt": "2026-06-15T12:00:00Z",
 "summary": "On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools.",
 "timeline": [
  {
   "date": "2026-06-08",
   "title": "Attackers used stolen keys to take over Safe multisigs on Ethereum (3 of 6) and BSC (3 of 5), gained ProxyAdmin control and drained about 141.2M H.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73"
  },
  {
   "date": "2026-06-09",
   "title": "Founder Terence Kwok confirmed the incident; the team halted deposits and withdrawals on the affected bridges as H fell from $0.731 to $0.0796.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73"
  },
  {
   "date": "2026-06-15",
   "title": "Halborn's analysis said malware with root access on a developer computer collected seven keys left there by an accidental backup at mainnet launch; ZachXBT questioned that explanation.",
   "sourceUrl": "https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Humanity Protocol Loses $36M After Private Keys 'Compromised,' Token Crashes 73%",
   "url": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73",
   "publisher": "Decrypt",
   "date": "2026-06-09"
  },
  {
   "kind": "writeup",
   "title": "Explained: The Humanity Protocol Hack (June 2026)",
   "url": "https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026",
   "publisher": "Halborn",
   "date": "2026-06-15"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you hold H tokens or used Humanity Protocol's bridges or H liquidity pools around 8 June 2026.\n\n## What to do now\n- Don't use the bridge or H pools until the team confirms they are safe.\n- Beware of fake 'refund' or 'token migration' sites; use only links from official channels.\n\n## How to avoid this\n- For teams: never back up signing keys onto developer machines, give each multisig signer a separate hardware wallet, and put timelocks on bridge upgrades.\n- For holders: check who controls a token's bridge and upgrade keys before holding large amounts.",
 "notes": null,
 "agentBrief": "# Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys\n\n- Severity: Critical · Status: Partly contained (past)\n- Chains: Ethereum, BNB Chain · Method: Leaked private keys and seed phrases\n- Started: Jun 8, 2026 · Last update: Jun 15, 2026 · Reported stolen: $36M\n- Who/what: Humanity Protocol (H token) bridges and treasury\n\nOn 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools.\n\n## Am I affected?\nIf you hold H tokens or used Humanity Protocol's bridges or H liquidity pools around 8 June 2026.\n\n## What to do now\n- Don't use the bridge or H pools until the team confirms they are safe.\n- Beware of fake 'refund' or 'token migration' sites; use only links from official channels.\n\n## How to avoid this\n- For teams: never back up signing keys onto developer machines, give each multisig signer a separate hardware wallet, and put timelocks on bridge upgrades.\n- For holders: check who controls a token's bridge and upgrade keys before holding large amounts.\n\n## Sources\n- Humanity Protocol Loses $36M After Private Keys 'Compromised,' Token Crashes 73% (Decrypt, 2026-06-09): https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73\n- Explained: The Humanity Protocol Hack (June 2026) (Halborn, 2026-06-15): https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026\n\nFull record: https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026 · JSON: https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}