Humanity Protocol lost about $36 million in the week of June 8 because a multisig that looked safe on-chain was a single laptop in practice. The contracts behaved exactly as written, but the keys did not. If your institution holds digital assets behind a multisig, the lesson sits in your operations, not your code: a quorum only protects you if the keys are actually separated, and the moment they share a device your 3-of-6 is a 1-of-1. This one is for custody, security, and compliance teams.
What happened
Humanity Protocol is a decentralized identity project, a palm-scan competitor to Worldcoin, backed by Pantera Capital and Jump Crypto at a $1.1 billion valuation last year. On June 8 and 9 an attacker took control of the project’s token bridges on two chains and walked out with roughly $36 million in H, the project’s token. H fell from about 67 cents before the breach to as low as 5 cents during it, and has since recovered to around 20 cents.
The root cause was not a smart contract bug. Founder Terence Kwok told CoinDesk the team had set up the multisig across four individuals, as it should be. During setup, some of the keys were “accidentally backed up to a compromised device.” That device was an employee’s laptop, and it held enough keys to cross the approval threshold on both chains at once.
On Ethereum the attacker held three of the six keys controlling the bridge’s admin account, transferred ownership to their own wallet, swapped the bridge contract for a malicious version, and swept about 141.2 million H in a single transaction. On BNB Chain they repeated the pattern with three of five keys, seized the token contract’s proxy admin, installed an unlimited mint function, and minted hundreds of millions of fresh H straight to their wallet. The total impact across both chains was roughly 447 million H stolen or minted.
The forensic angle
This is a “keys, not code” case, and it traces cleanly because the attacker had to act on-chain in the open. The sequence on each chain is the evidence: the ProxyAdmin ownership transfer to the attacker wallet, the contract upgrade to the malicious implementation, then the sweep or the mint. Each of those is a timestamped transaction with a clear before-and-after on the bridge’s admin slot. For anyone building the case, the attacker wallet is the anchor and the upgrade transaction is the moment of compromise.
The attacker did not sit on illiquid H. They sold into liquid assets fast, converting to roughly 18,510 ETH (about $30.8 million) and 1,548 BNB (about $924,000), then moved the proceeds out. That conversion step is where tracing earns its keep. Swaps and withdrawals leave a path through DEX routers and into deposit addresses, and where any of those addresses sit at a centralized exchange, that is a freeze point if the request reaches the right desk in time. Worth flagging for accuracy: on-chain investigator ZachXBT assessed that a separate round of suspicious market-making in H ahead of a scheduled token unlock was independent of the key compromise, so the two should not be conflated in a report.
Humanity halted deposits and withdrawals on the affected bridges, published a tracker of compromised addresses, offered a $1 million USDT bounty for information leading to recovery, and is working with exchanges and law enforcement. The published tracker matters for recovery work: it gives every VASP and analytics provider a consistent set of addresses to screen against, which is the difference between a coordinated freeze effort and a dozen desks guessing.
Who this hits
This is an institutional failure, and the institutions exposed are not only the protocol. Any exchange that listed H, any custodian holding it, any market maker quoting it, and any compliance team screening counterparties touched this within hours. The retail holders who watched H fall 90% are the visible victims, but the structural lesson lands on every team that runs a multisig or signs for client assets. A 3-of-6 reads as resilient in a board deck. It is only as resilient as the worst-secured device that holds a quorum of those keys.
What it means for institutions
Treat key distribution as the security boundary in its own right. The whole point of a threshold signature is that no single compromise crosses the line, and that property only holds if generation, backup, and storage are physically and organizationally separated. Map where every key in every quorum actually lives, including the forgotten copies made “just during setup.” A key that was generated on one machine and never provably wiped is a key that still lives there.
Separate the three things Humanity did right in principle but mixed in practice: a licensed custodian for treasury, MPC for operations, and raw multisig for contract admin each have a place, but the admin keys that can upgrade a bridge or mint supply are the crown jewels and deserve the strictest handling, ideally hardware-isolated and never backed up to a general-purpose laptop. Build the assumption of compromise into the design: if one signer’s device is owned, the quorum should still hold.
And prepare the recovery path before you need it. The window between a malicious upgrade and funds reaching an exchange is measured in hours, not days, and the institutions that recover anything are the ones who can produce an attributed address set and a freeze request fast. That is the work Recoveris does in the Aftercare Protocol: rapid validation, tracing across the swap and bridge hops, and freeze requests through a network of 150+ VASPs, with a court-ready report at the end.
Sources
- Humanity’s $36 million exploit happened because a ‘multisig’ lived on one laptop (CoinDesk)
- Humanity Protocol token crashes more than 80% after a $32 million private-key hack (CoinDesk)
- Wallets linked to Humanity Protocol drained for over $32 million (The Block)
- Three breach vectors, 447M tokens: Humanity Protocol details $H exploit (Crypto Times)
- Humanity Protocol loses $36M after private keys ‘compromised’ (Decrypt)
If your platform or users have been affected by recent exploits, immediate forensic intervention is critical to tracing and freezing assets before they reach obfuscation services.
