Humanity Protocol: phishing malware on a director’s laptop exposed seven production keys

What happened

• 8 to 9 Jun 2026: about USD 36M lost. About 141M H drained from the Ethereum bridge lockbox, and more than 122B H minted on BNB Smart Chain against a prior supply of about 141M.
• Root cause per QuillAudits’ analysis and Quantstamp’s incident response report (as reported): a phishing email posing as a Bithumb token lockup schedule update, sent to director Chong Yee Wai on 5 Jun, installed malware with full remote access. Seven keys (one admin hot wallet, three of six Ethereum Safe signers, three of five BSC Safe signers) were backed up on that one machine.
• Attribution: Quantstamp said the malware was signed with a South Korean Hancom certificate, “characteristic of DPRK intrusions”, and stopped short of a definitive attribution.
• Response: Ethereum H frozen by a clean multisig. BSC deployment remained under attacker control. Old H sunset, new audited H airdropped 1:1 to pre-snapshot holders with a compensation fund.

Sources

• https://www.quillaudits.com/blog/hack-analysis/humanity-protocol-admin-key-compromise
• https://cointelegraph.com/news/humanity-protocol-hack-linked-north-korean-actors-quantstamp
• https://thedefiant.io/news/hacks/humanity-protocol-post-mortem-malware-developer-machine-seven-keys

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.