Humanity Protocol suffered a security breach that drained roughly $36 million from its treasury this week. An attacker obtained a foundation member's private keys and used them to empty 17 or more Gnosis Safe wallets across Ethereum and BNB Chain. The hacker then minted an additional 100 million H tokens on Binance Smart Chain, sending the token price down nearly 70% in hours.
How the attacker moved
The breach didn't involve a smart contract exploit — it was a straight key compromise. The foundation member's private keys gave the attacker direct control over the multisig wallets that held the bulk of the project's funds. Once inside, the drain was fast: the attacker swept ETH and BNB from each wallet, then used the access to mint fresh H tokens on BSC. Those minted tokens were likely part of the selling pressure that cratered the price.
Why the minting matters
Minting 100 million H tokens on BSC effectively diluted existing holders and added a huge supply shock at the worst possible time. The H token, which had been trading in the low single digits, collapsed as the market absorbed the news and the new tokens hit exchanges. The 70% drop wiped out millions in market cap and left investors holding bags that lost most of their value in minutes.
What Humanity Protocol said
The project confirmed the incident publicly, attributing it to a compromised foundation key. It has not yet detailed whether the key was stored on a hot wallet, a hardware device, or if there were any multi-signature safeguards that failed. Security teams were reportedly working to lock down remaining contracts and assess the full scope of the damage. No timeline for recovery or compensation has been announced.
The bigger question
For a protocol that sells itself on decentralized identity and human verification, this kind of centralized key risk is awkward. The attack didn't target users directly — it hit the foundation's own wallets — but the minted tokens and price crash hit everyone holding H. The project now faces the challenge of restoring trust while dealing with a treasury that just lost $36 million. Expect more details on how the key was stored and what changes are coming to prevent a repeat. The community will be watching for a post-mortem and any plans to make affected holders whole.
