Humanity Protocol Exploited for Over $30 Million in Private Key Compromise

The Humanity Protocol, dubbed the “Chinese Worldcoin,” has been exploited for more than $30 million through a private key compromise, sending the price of H tokens plummeting on Tuesday.

“We’ve detected a security incident involving the compromise of private keys belonging to a member of the Humanity Foundation,” said Terence Kwok, founder and CEO of Humanity Protocol, on Tuesday.

Kwok advised users not to interact with the bridge or any liquidity pools until it has been deemed safe and added that the team was working with security experts, but did not provide any further details at the time.

Humanity is a zkEVM blockchain-based decentralized identity project focused on Proof of Humanity and uses privacy-preserving palm biometrics.

Prices for the H token have collapsed over the past 12 hours, falling 85% from around $0.70 to $0.08 at the time of writing, according to CoinGecko.

Onchain investigator “Specter” said it appears that wallets linked to, or that have interacted with Humanity Protocol, are being compromised in an ongoing attack that has drained as much as $30 million in the project's native H token.

Arkham Intelligence also reported that the exploiter had stolen more than $30 million and was swapping H tokens through Kyber Network and PancakeSwap, among other DEXes.

Private key compromises continue to increase. There have been several high-profile private key compromises this year, one of the largest being the Drift Protocol exploit in April. Attackers affiliated with the North Korean Lazarus Group gained control of the security council admin keys, resulting in the loss of $280 million.

Others include Step Finance, Resolv, Volo Vault, Echo Bridge, Bankr, Polymarket, StablR, Stake DAO, Gravity Bridge, and Aelphium Bridge.

Wallet or private key compromises were the second-most costly attack vector in May, with $13.7 million stolen, CertiK reported.