Humanity Protocol $32M Hack: ZachXBT Says It May Be Staged

Humanity Protocol, the palm-scan biometric identity project positioned as a rival to Sam Altman’s Worldcoin, lost more than $32 million on June 9, 2026, after attackers drained 17 foundation wallets, swapped the stolen H tokens for ETH, and then minted an additional 100 million H tokens on BNB Chain. The H token fell from $0.67 to a low of $0.05 intraday, a collapse of more than 90%, before stabilizing around $0.12 to $0.13. Market capitalization dropped from roughly $1.3 billion to approximately $225 million in hours. Trading volume surged to over $600 million as panic selling dominated every venue where H was listed.

The team attributed the incident to compromised private keys belonging to a member of the Humanity Foundation. Founder Terence Kwok confirmed this publicly on X and said the team was working with security experts and exchange partners. What the team did not explain: how a single foundation member’s keys gave an attacker the ability to drain 17 separate wallets, mint 100 million new tokens on BNB Chain, and take over the H token’s proxy administrator contract. On-chain investigator ZachXBT has called the incident “possibly staged” and suggested the team colluded with a market maker. He also noted that three of the four project leaders have histories involving lawsuits, financial fraud, and management failures. The question of whether this was an external attack or an inside job has not been resolved.

How It Happened

The attack began early Tuesday morning UTC. On-chain analyst Specter was the first to flag suspicious wallet activity, reporting that addresses which had interacted with Humanity Protocol were being continuously targeted. Within minutes, PeckShieldAlert confirmed active wallet compromises across the ecosystem. The initial losses appeared to be around $5 million before the full scale became clear.

The mechanics of the attack went in two distinct phases. Phase one: the attacker used compromised private keys to directly access and drain at least 17 wallets associated with the Humanity Foundation, converting stolen H tokens into ETH through decentralized exchanges. Of the $32 million total, $23.7 million was swapped into ETH and approximately $7.9 million remained in H tokens at the time of reporting. Because the attacker was simultaneously dumping H into the market, every swap suppressed the token price further, creating a self-reinforcing collapse.

Phase two was more alarming. Security firm Blockaid reported that the attacker had taken control of the H token’s proxy administrator contract on BNB Chain. This gave them the ability to mint new H tokens from nothing. They minted 100 million H tokens, worth approximately $11 to $12.9 million at the time, and transferred them to a fresh wallet. Proxy administrator access is not obtained from a single employee’s private key under any standard security architecture. Gaining proxy admin control requires access to the contract’s upgrade authority, which is a separate and more privileged key than the wallet keys that were supposedly compromised. This is the detail that made ZachXBT’s “possibly staged” assessment credible to the on-chain security community.

The Impact

The H token was at approximately $0.67 to $0.85 before the incident. It fell to a low of $0.05 intraday and stabilized around $0.12 to $0.13 as of the time of writing, representing a loss of approximately 82 to 83% on the 24-hour period and a collapse of roughly 90% from the recent high of $0.84 to $0.85. The market capitalization fell from approximately $1.3 billion pre-incident to around $225 million. Trading volume surged to over $600 million in 24 hours, almost entirely driven by panic selling, not buying.

The timing made the collapse especially painful for recent buyers. In the days before the hack, H had surged nearly 875% above its yearly low, meaning a large number of investors had entered the token at elevated prices in the days immediately before the collapse. Those holders have been almost entirely wiped out. The 100 million H tokens minted on BNB Chain remain a source of ongoing selling pressure: that supply is worth approximately $12 to $13 million at current prices and has not yet fully hit the market.

A secondary concern is the June 25 token unlock. On-chain data shows approximately 266 million H tokens worth around $28 million at pre-hack prices are scheduled to unlock across six allocations including the foundation treasury and a strategic reserve. At current depressed prices those tokens are worth considerably less, but the unlock date creates a hard deadline for any recovery narrative. If the team has not demonstrated meaningful progress by June 25, the unlock will add further sell pressure to a token already trading 90% below its recent high.

ZachXBT Says “Possibly Staged”: Here Is Why That Is Credible

ZachXBT is the on-chain investigator whose track record includes identifying the Lazarus Group connection to multiple billion-dollar DeFi hacks before law enforcement confirmed it. When he calls an incident “possibly staged,” it is not speculation for engagement. It is a specific technical and behavioral assessment. His reasoning in this case rests on several points.

First, the proxy admin access. A single foundation member’s compromised private key should not grant proxy admin control over the BNB Chain H token contract. These are separate privileges in any properly structured token architecture. The attacker’s ability to mint 100 million new H tokens suggests either extraordinarily poor key management where a single key controlled multiple critical functions, or insider knowledge of which keys to target and what those keys could authorize.

Second, the team background. ZachXBT noted that three of the four project leaders have documented histories of lawsuits, financial fraud, and ineffective management. HTX and Foresight News reporting adds that Humanity Protocol had previously faced controversy: reports suggesting only around 1 million of 9 million registered identities had completed biometric verification, indicating 88% of user registrations may have been bots or incomplete. The project denied this but never fully addressed it. For a project already carrying this level of reputational baggage, the timing of a hack that wiped out nearly all recent gains immediately after a near-9x pump from yearly lows raises legitimate questions about whether holders were positioned to absorb or benefit from the collapse.

Third, the response. The team confirmed the hack relatively quickly but provided no technical details about how a single key granted multi-contract access, offered no compensation framework, and did not immediately freeze the token or seek emergency exchange suspensions as most credible projects do in the first hour of a confirmed exploit. CryptoTimes notes the team also suggested it was working with a market maker, which ZachXBT flagged as a potential vector for coordinated selling.

The 2026 Private Key Pattern: Third Major Attack in Two Months

CoinDesk’s reporting notes this explicitly: the Humanity Protocol hack fits the dominant pattern of 2026, in which the biggest losses have come from stolen keys rather than flawed code. DeFi hack losses surpassed $1 billion in the first four months of 2026 alone, with key management failures driving a disproportionate share of that damage. The Drift Protocol attack in April 2026 cost approximately $285 to $286 million. The Kelp DAO attack the same month cost approximately $292 to $294 million through a single-validator bridge compromise. Humanity Protocol adds another $32 million to that tally in June.

The pattern across all three is the same: attackers are not breaking smart contracts. They are obtaining the keys that control them. In the Drift and Kelp cases, the keys were obtained through long-form social engineering, conference infiltration, and trust-building over months, tactics attributed to the Lazarus Group. In the Humanity case, whether the key was obtained externally or was already known to someone inside the project is the open question.

The implication for the industry is one we have written about repeatedly this year: formal security audits of smart contract code are necessary but not sufficient. The Radiant Capital hack, which we covered in depth, involved no smart contract vulnerability at all. The Lazarus Group exploited the human layer. The Flooring Protocol exploit we covered yesterday exploited a code vulnerability hidden from auditors through gas optimization. And now Humanity Protocol shows a third attack surface: administrative key management, where the keys that control token minting and proxy contracts are not secured with the same rigor as the contracts themselves.

This article is for informational purposes only. Sources: CoinDesk, The Block, BeInCrypto, CryptoTimes (ZachXBT), KuCoin, Blockaid, Specter, Lookonchain, PeckShieldAlert, DropsTab. Published June 9, 2026.

Subscribe To Our Newsletter

Join our mailing list to receive the latest news and updates from our team.

SUBSCRIBE!

You have Successfully Subscribed!