Humanity Protocol hack of 141 million H tokens points to North Korean hackers

Security firm Quantstamp publishes the results of its investigation into the hack of Humanity Protocol on 8 June. The attackers gained access to a director’s device through a targeted phishing attack, copied wallet data and private keys, and managed to move as many as 141.18 million H tokens. The patterns found strongly indicate the involvement of North Korean hackers.

How the attack unfolded

The attack begins with a phishing message through which the hackers install malware on the device of a Humanity Protocol director. Via this malware, they gain remote access to the system and manage to copy wallet data and private keys. With that data in hand, they upgrade the Ethereum H token contract and send the 141.18 million tokens to addresses under their control.

On the BNB Smart Chain, the attackers go a step further. There, they take control of a ProxyAdmin contract and mint additional H tokens. The combination of both attacks makes it clear that the hackers were well prepared and attacked multiple chains simultaneously. For the Ethereum price, which at the time of writing stands at $1.673,82. the hack has no directly noticeable effect.

Traces lead to North Korea

In its report, Quantstamp states that the tools used and the patterns in certificate signing are characteristic of attacks linked to the DPRK, or North Korea. This type of attack, in which phishing is used to gain access to private keys, fits a broader pattern of state-sponsored North Korean cybercrime targeting the crypto sector.

The hack of Humanity Protocol is thus another example of how dangerous targeted phishing attacks are for people in key positions within crypto projects. The incident shows that active threats also exist on the BNB Smart Chain, where attackers take over contract management to mint additional tokens.