Humanity Protocol lost over $36 million due to a laptop breach exposing multisig wallet keys, raising security concerns for digital asset management.
Humanity Protocol suffers a major security breach, resulting in a theft exceeding $36 million in tokens.
Humanity Protocol has reported a significant security incident that led to the theft of over $36 million in H tokens following a breach of an employee's laptop. The compromised device contained critical keys for managing the project's token bridges, which are essential for transferring H tokens across different blockchains.
The attacker exploited vulnerabilities by accessing three of the six Ethereum admin keys and three of the five BNB Chain keys, all of which were stored on the same laptop. This oversight allowed them to bypass the multisignature wallet's security measures, which are designed to require multiple keys for any fund movement.
Once inside, the hacker took control of the Ethereum bridge, changing ownership to their own wallet and deploying malicious code that resulted in the theft of approximately 141 million H tokens. A similar approach was taken on the BNB Chain, where the attacker minted around 200 million new H tokens.
In response to the incident, Humanity Protocol has paused all bridge transactions and is working with exchanges and law enforcement to recover the stolen assets. The organization has also removed its team page from its website as part of its security measures.
Humanity Protocol's founder Terence Kwok explained that while the project had initially intended to set up a multisig wallet distributed among multiple individuals, some keys may have been inadvertently backed up on the compromised device during setup. He emphasized their use of a licensed custodian for most of their treasury operations and noted that despite efforts to secure the keys, this breach occurred.
The fallout from the breach has been significant, with H token prices plummeting from a pre-breach high of 67 cents to as low as 5 cents. Currently, the token has partially rebounded to around 20 cents but remains well below its previous value. This incident raises concerns about the security practices of digital asset management, especially for startups backed by major investors like Pantera Capital and Jump Crypto.
