WuBlockchain
Humanity Protocol's investigation report on the June 8 attack pins the breach on a single compromised developer machine, not a contract vulnerability. Malware on the device gave the attacker full root access, and seven private keys had been inadvertently backed up to that machine during the project's mainnet launch around June 2025.
Why it matters
The keys exposed from the one device included the admin hot wallet key, three Ethereum Safe owner keys, and three BSC Safe owner keys — a complete ownership set for the protocol's cross-chain treasury. Because the attacker held legitimate keys, every subsequent transfer, Safe transaction, and proxy upgrade was on-chain valid: the protocol's own investigation explicitly rules out a smart-contract bug in the bridge, token, or Safe contracts.
Market impact
Total losses exceeded $31 million. The root cause reads as an operational-security failure rather than a code exploit: developers storing production key material on a workstation that could be infected. The chain of custody is what got drained, and no amount of contract audit would have caught it.
Source: [Notion | Where teams and agents work together](https://app.notion.com)
Frequently asked questions
-
Was the Humanity Protocol June 8 attack a smart-contract exploit?
No. The protocol's investigation report rules out a contract bug — the bridge, token, and Safe contracts behaved as designed. The attacker used legitimately held private keys obtained from a compromised device.
-
How did the attacker obtain seven private keys from a single device?
A developer machine was infected with malware, granting the attacker full root access. Seven keys — the admin hot wallet key, three Ethereum Safe owner keys, and three BSC Safe owner keys — had been inadvertently backed up to that device during the mainnet launch around June 2025.
-
How much was stolen in the Humanity Protocol attack?
Losses exceeded $31 million. The protocol's report does not break the figure down by chain.
-
Why couldn't the on-chain activity be flagged as suspicious?
Every transfer, Safe transaction, and proxy upgrade was authorized with legitimate private keys. To the contracts and to block explorers, the attacker's activity looked identical to authorized protocol operations.
-
What is the main lesson from the Humanity Protocol post-mortem?
Production private keys should never sit on a developer workstation reachable by malware. The chain of custody for key material — not contract code — was the attack surface, and no amount of smart-contract auditing would have prevented it.
CoinDesk
CryptoSlate
Lookonchain
WatcherGuru
TheBlock