# Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys

- Severity: Critical · Status: Partly contained (past)
- Chains: Ethereum, BNB Chain · Method: Leaked private keys and seed phrases
- Started: Jun 8, 2026 · Last update: Jun 15, 2026 · Reported stolen: $36M
- Who/what: Humanity Protocol (H token) bridges and treasury

On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools.

## Am I affected?
If you hold H tokens or used Humanity Protocol's bridges or H liquidity pools around 8 June 2026.

## What to do now
- Don't use the bridge or H pools until the team confirms they are safe.
- Beware of fake 'refund' or 'token migration' sites; use only links from official channels.

## How to avoid this
- For teams: never back up signing keys onto developer machines, give each multisig signer a separate hardware wallet, and put timelocks on bridge upgrades.
- For holders: check who controls a token's bridge and upgrade keys before holding large amounts.

## Sources
- Humanity Protocol Loses $36M After Private Keys 'Compromised,' Token Crashes 73% (Decrypt, 2026-06-09): https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73
- Explained: The Humanity Protocol Hack (June 2026) (Halborn, 2026-06-15): https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026

Full record: https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026 · JSON: https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.