WuBlockchain
Quantstamp's investigation into the June 8 Humanity Protocol H token incident is public, and the firm's findings point to a North Korea-linked intrusion. Attackers phished a director's device, copied wallet data and private keys, then upgraded the Ethereum H token contract and moved roughly 141.18 million H tokens. On BNB Smart Chain, the attackers also took control of a ProxyAdmin contract and minted additional supply.
Why it matters
The attack path is the structural read. A single director-level phishing compromise gave the operator both private keys and the ability to push contract upgrades — meaning the multi-chain surface area, the proxy admin, and the mint authority all sat behind one human endpoint. Quantstamp said the tooling and certificate-signing patterns observed are characteristic of DPRK-linked intrusion sets, the same playbook that has drained billions from DeFi across the last two years.
Market impact
A ~141M H drain against circulating supply is a deep liquidity shock for the token, and the BNB Chain mint side extends the damage beyond a single chain. The operational lesson for the rest of the sector: signer isolation, hardware-wallet enforcement on upgrade keys, and timelocks on ProxyAdmin authority are no longer optional hardening — they are the difference between an exploit and a contained incident.
Source: [$H Incident Summary | Humanity](https://www.humanity.org/hincidentupdate)
Frequently asked questions
-
What happened in the Humanity Protocol H token hack?
Quantstamp's investigation found attackers phished a director's device on June 8, copied wallet data and private keys, then upgraded the Ethereum H token contract and moved approximately 141.18 million H tokens. They also seized a ProxyAdmin contract on BNB Smart Chain and minted additional H.
-
Did North Korea carry out the Humanity Protocol hack?
Quantstamp said the tooling and certificate-signing patterns observed in the intrusion are characteristic of DPRK-linked attack sets, but the firm stopped short of a formal attribution. The same playbook has been tied to North Korea-linked groups in prior DeFi incidents.
-
How much was stolen in the H token exploit?
Roughly 141.18 million H tokens were moved off Ethereum after the attackers upgraded the H token contract. Additional H was minted on BNB Smart Chain via a seized ProxyAdmin contract, extending the damage across both chains.
-
What is the ProxyAdmin contract and why does it matter?
ProxyAdmin is the role authorized to upgrade the implementation behind a proxy contract. Whoever controls it can swap the contract's logic in place — and in this case also mint additional H on BNB Smart Chain, which is why seizing it was as damaging as the Ethereum key compromise.
-
What should other crypto teams learn from this incident?
The structural read is that a single director-level phishing compromise gave attackers private keys, an upgrade path, and cross-chain mint authority. Signer isolation, hardware-wallet enforcement on upgrade keys, and timelocks on ProxyAdmin authority are the hardening steps that would have contained the blast radius.
CryptoSlate
CoinDesk
TheBlock
Lookonchain