Humanity Protocol hacked via one compromised device with seven private keys

Humanity Protocol publishes a research report on the 8 June attack, in which the attacker managed to obtain seven private keys via a single compromised device. The damage amounts to more than $31 million. It is not a vulnerability in the smart contracts, but a human error in key storage.

Malware on developer machine gives access to all keys

According to the official incident report from Humanity Protocol, a colleague’s machine became infected with malware, giving the attacker full root access to the device. During the project’s mainnet launch around a year ago in June 2025, several private keys were accidentally stored as backups on this device.

It concerns seven keys in total: the admin hot wallet private key, three ETH Safe owner keys and three BSC Safe owner keys. Because all these keys were stored in one place, that was sufficient to gain full control. As a result, the attacker only had to find one weak point. When exactly the attacker gained access to the device and how long they held the keys before the attack on 8 June remains unclear. The report indicates that the attack may have been planned well in advance.

No bug in the code, but an operational security problem

Humanity Protocol explicitly states that there is no flaw in the smart contracts, the bridge, the token or the Safe. All actions carried out by the attacker, including transfers, Safe transactions and proxy upgrades, were authorised using legitimate private keys. Technically, therefore, the attacker acted entirely as a legitimate user.

The protocol concludes that the attack was made entirely possible by deficient storage of production keys. They were kept on a general developer device instead of on isolated hardware wallets. The report describes this as a human and operational security failure. The total damage exceeds $31 million, making this one of the larger incidents in the recent Ethereum ecosystem.