Quick Overview
- A foundation member’s compromised private keys led to Humanity Protocol losing more than $30 million in an exploit
- H token value plummeted 85–90%, dropping from approximately $0.67 to a low of $0.05
- Hackers drained a minimum of 17 wallets and created an additional 100 million H tokens on BNB Chain
- Stolen tokens were liquidated through decentralized exchanges such as PancakeSwap and Kyber Network
- 2026 has seen private key compromises emerge as the leading crypto attack vector, causing hundreds of millions in damages
On Tuesday, Humanity Protocol—a decentralized identity platform utilizing palm-scan biometric technology—fell victim to a major security breach when hackers obtained private keys from a Humanity Foundation member.
[[EMBED_0]]
CEO and Founder Terence Kwok publicly acknowledged the incident, stating that the organization was collaborating with security professionals and cryptocurrency exchange partners to mitigate the ongoing situation.
The breach resulted in the compromise of no fewer than 17 project-associated wallets. According to blockchain analytics, the financial damage surpassed $32 million and continued to grow as the investigation progressed.
The perpetrators have been liquidating the stolen H tokens for ethereum through various decentralized trading platforms, particularly Kyber Network and PancakeSwap. On-chain analysis reveals that the attackers also generated an extra 100 million H tokens on BNB Chain, valued at approximately $11 million, which intensified the downward price pressure.
H Token Experiences Catastrophic Price Drop
Following disclosure of the security incident, the H token experienced a severe price collapse. The cryptocurrency tumbled from roughly $0.67 to approximately $0.13, with a brief dip to $0.05—representing an intraday loss approaching 90%. During the reporting period, the token was fluctuating between $0.08 and $0.13, marking a daily decline exceeding 80%.

Kwok advised community members to immediately cease using the project’s cross-chain bridge and liquidity pools pending security clearance. The bridge infrastructure enables token transfers across different blockchain networks.
Blockchain investigator “Specter” observed that wallets associated with or having previous interactions with Humanity Protocol appeared to be specifically targeted in what seemed like a continuing assault.
Arkham Intelligence validated the reported figures, documenting that the attacker had extracted over $30 million in assets and was continuously liquidating the tokens.
Humanity Protocol positions itself as a competitor to Sam Altman’s Worldcoin project. The platform leverages zero-knowledge proof technology combined with palm biometric authentication, allowing users to verify their identity while maintaining privacy, all operating on a zkEVM blockchain infrastructure.
2026 Sees Private Key Exploits Become Primary Threat Vector
The Humanity security incident reflects a broader trend observed throughout 2026. This year’s most significant cryptocurrency losses have stemmed from compromised private keys rather than vulnerabilities in smart contract architecture.
Last April, Solana-based trading platform Drift suffered approximately $285 million in losses when attackers obtained an administrative key. During that same period, Kelp DAO experienced losses near $292 million through a compromised single-validator bridge, an attack subsequently attributed to North Korea’s Lazarus Group.
Additional projects victimized by key-based exploits in 2026 include Step Finance, Resolv, Volo Vault, Echo Bridge, Bankr, Polymarket, StablR, Stake DAO, Gravity Bridge, and Aelphium Bridge.
Cybersecurity firm CertiK identified wallet and private key breaches as the second-most expensive attack category in May specifically, with $13.7 million stolen during that month alone.
The Humanity Protocol incident remains under active investigation, with the team yet to announce a timeline for resuming bridge and liquidity pool operations.





