{
 "tag": "malware",
 "name": "Malware",
 "group": "Other",
 "incidents": [
  {
   "slug": "humanity-protocol-dev-machine-keys-jun-2026",
   "title": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026",
   "json": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "bsc"
   ],
   "method": "key-leak",
   "product": "Humanity Protocol (H token) bridges and treasury",
   "tags": [
    "ethereum",
    "bsc",
    "key-leak",
    "humanity-protocol",
    "malware",
    "infostealer",
    "developer-machine",
    "gnosis-safe",
    "multisig",
    "bridge",
    "h-token"
   ],
   "amountUsd": 36000000,
   "victims": null,
   "startedAt": "2026-06-08",
   "closedAt": "2026-06-15",
   "updatedAt": "2026-06-15T12:00:00Z",
   "summary": "On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools."
  },
  {
   "slug": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "title": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025",
   "json": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Nailwal said the calls showed AI-generated videos of him, the Polygon Ventures lead and a supposed team member, used to get targets to install malware."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "social-engineering",
   "product": "Startup founders in Polygon's investment network",
   "tags": [
    "multi-evm",
    "social-engineering",
    "deepfake",
    "zoom",
    "fake-meeting",
    "telegram",
    "account-takeover",
    "polygon",
    "malware",
    "founders",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-05-13",
   "closedAt": "2025-05-14",
   "updatedAt": "2025-05-14T12:00:00Z",
   "summary": "On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know."
  }
 ],
 "changes": [
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-15",
   "title": "Halborn's analysis said malware with root access on a developer computer collected seven keys left there by an accidental backup at mainnet launch; ZachXBT questioned that explanation.",
   "sourceUrl": "https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-09",
   "title": "Founder Terence Kwok confirmed the incident; the team halted deposits and withdrawals on the affected bridges as H fell from $0.731 to $0.0796.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-08",
   "title": "Attackers used stolen keys to take over Safe multisigs on Ethereum (3 of 6) and BSC (3 of 5), gained ProxyAdmin control and drained about 141.2M H.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-14",
   "title": "CryptoSlate reported the warning and his advice to sign wallet transactions only from a separate, dedicated laptop.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  },
  {
   "incident": "polygon-cofounder-deepfake-zoom-calls-may-2025",
   "incidentTitle": "Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-05-13",
   "title": "Nailwal warned on X that a hijacked Polygon Ventures Telegram account was sending founders to deepfake Zoom calls.",
   "sourceUrl": "https://cryptoslate.com/polygons-co-founder-warns-of-sophisticated-deepfake-scam-using-his-likeness-targeting-startups/",
   "url": "https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025"
  }
 ]
}