Humanity Protocol disclosed that attackers stole more than $36 million of its H token after compromising an employee's laptop that held enough multisig keys to take control of the project's bridges on two separate blockchains — a fundamental security failure for a startup that had raised $20 million from prominent crypto-focused investors just last year.

Market Context

The exploit represents one of the more significant decentralized finance breaches of 2026, occurring amid heightened scrutiny of cross-chain bridge security following years of billion-dollar losses from similar attacks. Humanity's H token plunged more than 80 percent immediately after the breach became public, falling from roughly 67 cents to approximately 5 cents at its low point before recovering to around 20 cents, according to CoinGecko data. The project had achieved a $1.1 billion valuation during its fundraising round with Pantera Capital and Jump Crypto.

Analysis

According to an incident update shared with CoinDesk, the breach began when an employee's laptop was compromised. That machine contained several keys controlling Humanity's token bridges — the infrastructure that moves H tokens between blockchains. The project had set up multisignature wallets requiring multiple separate approvals for any transaction, a security design intended to spread control across different individuals and devices so that no single point of failure could move funds.

In this case, however, all the required keys were backed up on a single device. When attackers compromised that laptop, they gained access to enough keys to cross the approval threshold on both chains simultaneously — defeating the entire purpose of multisig protection. Humanity founder Terence Kwok confirmed in a Telegram message to CoinDesk that the team had intended to set up wallets across four individuals as protocol requires, but some keys were accidentally backed up to a compromised device during setup.

On Ethereum, the attacker obtained three of six keys controlling the bridge's admin account and transferred ownership to their own wallet. They then swapped the bridge's code for a malicious version and drained approximately 141 million H tokens in a single transaction. On BNB Chain, where only three of five keys were needed, the attacker installed code featuring an unlimited mint function and minted roughly 200 million new H tokens directly to their wallet.

Prominent on-chain investigator ZachXBT noted that the key compromise appeared unrelated to a separate round of suspicious market-making activity in the token during preceding weeks. He flagged questions about how H token prices shot up from 20 cents to 70 cents within two weeks ahead of a large scheduled token unlock — behavior that preceded the breach.

Key Numbers

- $36 million: Total value stolen in the exploit

- 141 million H: Tokens drained from Ethereum bridge in single transaction

- 200 million H: New tokens minted on BNB Chain by attacker

- 3 of 6 keys: Number required and obtained on Ethereum multisig admin account

- 3 of 5 keys: Number required and obtained on BNB Chain multisig

- $1.1 billion: Humanity Protocol valuation at time of Pantera/Jump Crypto investment

- $20 million: Amount raised in last funding round

- Approximately 80%: Decline in H token price following breach disclosure

What to Watch

Humanity has halted deposits and withdrawals on the affected bridges while working with exchanges and law enforcement to recover funds. The project has removed its team page from its website, a move that may complicate community relations during recovery efforts. Traders should monitor for any announcements regarding fund recovery progress, exchange delisting decisions, or regulatory inquiries into whether the pre-breach token price manipulation identified by ZachXBT warrants separate investigation. The project's next scheduled token unlock events and vesting schedules will also be critical to watch given the additional inflationary pressure from the 200 million newly minted tokens.

The incident underscores ongoing questions about multisig wallet implementation practices across early-stage Web3 projects, even those backed by institutional investors with established security standards.

Sources

Humanity Protocol Incident Update shared with CoinDesk; CoinGecko price data; ZachXBT on-chain analysis via Telegram; Humanity founder Terence Kwok statements via Telegram