Humanity Protocol suffers Private Key theft, H token crashes 90%

Humanity Protocol is the latest Web3 protocol to suffer an exploit, where the native token lost 90% of its value. The protocol’s holdings were compromised after a team wallet’s private keys were exposed. 

Humanity lost an immediate $4M from the wallet exploit, but the losses may be as large as $31M after the native H token also erased up to 90% of its value. The team warned against interacting with bridges and liquidity pools until control over multisig wallets is recovered. 

https://x.com/Humanityprot/status/2064167144120877127

Following the exploit, H recovered slightly, but still carried an 83% loss, down to $0.12. In the week before the crash, H performed one of its biggest vertical rallies and held near its all-time highs of up to $0.80. 

Humanity is the latest Web3 project to suffer an exploit, exposing further weaknesses in security. For the past year, hacks and exploits took over $1.47B from various protocols, targeting both large projects like KelpDAO, and niche liquidity hubs. 

Humanity Protocol aimed to combine privacy with proof of humanity, using palm prints to secure an on-chain identity. The protocol aimed to become multi-chain, and was also exposed to the risk of bridging and drained wallets.

What happened to Humanity Protocol? 

The underlying reason for the hack was that a member of the Humanity Foundation exposed their private keys. Over 19 wallets were drained, with up to $31M in estimated losses, as reported by DeFi llama. The exact estimates vary based on different on-chain data. The exploit was ongoing, with more illicit minting of H, and additional swaps through BNB Chain. The latest transaction intercepted through the attacker’s wallets created another 100M H tokens. 

The attack continued with more token mints, as Humanity estimated up to $36M in stolen value.

The initial reports showed wallets that interacted with Humanity Protocol were drained. Later, it became clear that all wallets were controlled by the team. Humanity Protocol also shows a high concentration of H tokens held by team wallets, as well as by wallet clusters, based on Bubblemaps data.

The coincidence of dumping H tokens just days after they reached new price records also raised potential questions on a deliberate exit disguised as a hack. H tokens have been trading for a little under a year, still relying on Gate and Bybit for their liquidity. 

After the hack, the H tokens stolen were stored into five destination addresses, with most of the funds immediately swapped into ETH. The fast movement of funds after the exploit and the shift to ETH also resembles the approach of DPRK hackers. 

The recent hack also happened before one of the expected big unlocks of H tokens. On June 25, Humanity Protocol is scheduled to unlock 2.86% of the total supply, or over 15% of the current free float. 

Humanity Protocol lost money for top VC backers

Humanity Protocol was not a niche Web3 project. The protocol raised $50M to reach a valuation of $1.1B. 

Pantera Capital was the project’s main backer for the second strategic raising round of $20M. Animoca Brands has also supported the project’s seed round. The project has been running since 2024, and is not a recent overhyped token, causing further damage to even legitimate-looking Web3 startups.

As a result, Humanity Protocol was operating under the playbook of VC-backed, low-float tokens. The low float allowed for dramatic appreciation of the H token, despite the recent worsening sentiment of crypto markets. 

On-chain researcher ZachXBT also noted Humanity Protocol most likely used aggressive market makers to achieve peak H valuations, demanding disclosure of the project’s trading practices.