Humanity Protocol Says Employee Laptop Breach Resulted in $36M Theft

Laptop Breach Hit Bridge Keys

The cleanest confirmed fact is that this was a key-control incident. CoinDesk reported that the bridge admin keys were stored on the compromised laptop, which allowed the attacker to meet both the Ethereum and BNB Chain signing thresholds.

That detail changes the risk analysis. A multisig wallet is supposed to require multiple independent approvals, but it only works as intended if the keys are separated across people, devices and security environments. If enough keys sit on one laptop, the structure can behave like a single point of failure.

On Ethereum, the attacker did not only move tokens out of a wallet. Humanity Protocol said the attacker seized control of the bridge ProxyAdmin, upgraded the bridge contract, and then moved about 141.2 million H tokens to attacker-controlled wallets.

On BNB Chain, the attacker used the same broad path but with a more damaging minting route. The project said a malicious implementation included an unlimited mint function, allowing the attacker to create 200,000,005 H tokens directly.

This is why the story has stronger search potential than a normal token dump. Readers are not only asking why H crashed. They are asking how a proof-of-humanity project could lose bridge control through private-key custody, and whether the reported multisig setup offered real separation.

H Token Selling Drained Liquidity

The market reaction followed the mechanics of the exploit. CoinDesk’s earlier report said H fell more than 80% as the attacker dumped stolen H for ether and minted additional H on BNB Chain.

CoinGecko’s intraday range showed the pressure clearly. H traded as low as $0.057809 on June 9 and later rebounded near $0.159682, but it was still down 34.8% over 24 hours at the time the data was checked. The token’s 24-hour volume, near $364.8 million, was larger than its market capitalization, a sign that turnover was extreme relative to the remaining value of the asset.

The loss estimate also changed as the incident widened. CoinDesk initially cited losses above $32 million from at least 17 wallets, while Humanity Protocol’s later update put the total above $36 million. The exact net loss may still change if funds are frozen, returned, bridged again, or sold into thin liquidity.

That is the same pattern Daily Crypto Briefs tracked in the Gnosis Pay Delay Module exploit, though the scale here is much larger. In both cases, the user-facing product depends on smart-account or bridge plumbing that most token holders cannot audit in real time.

The broader security backdrop is already weak. Our April roundup found that crypto platforms lost more than $605 million to cyberattacks in under 20 days, and many of those failures were not exotic code bugs. They came from signer workflows, bridges, domains, internal access and operational controls.

Recovery Depends on Key Rotation

Humanity Protocol’s next job is not only tracing the attacker. It has to show that the compromised administrative path has been removed, that bridge contracts cannot be upgraded through the same key set, and that any remaining owner keys have been rotated or replaced.

That is harder than posting a warning. Bridge users need to know which pools, routes and wrapped token supplies are safe, which balances are impaired, and whether exchanges have isolated deposits or markets tied to the compromised H supply.

The team also has to answer the custody question directly. If multiple required signatures were available from one employee laptop, then the threshold design did not provide the separation that users would normally assume from a multisig setup.

Market sentiment is already stressed, which makes recovery communication more important than usual.

The incident also intersects with the wallet-security pressure seen in Ledger and Trezor phishing infrastructure. Attackers keep moving toward the human and operational layers because those layers can be cheaper to break than audited code.

For now, the confirmed facts are enough to keep the story urgent: Humanity Protocol says a laptop compromise exposed bridge admin keys, H supply was stolen or minted across Ethereum and BNB Chain, and the token’s market structure absorbed a violent selloff. The next public updates need to clarify the final loss, the compensation plan, the bridge restart criteria and whether the project can prove that one compromised device cannot recreate the same failure.