Humanity Protocol hit by major hack: $36 million stolen

Humanity Protocol was the target of a coordinated attack on Tuesday evening. According to the team, hackers managed to break into the Hyperlane bridge and Binance Smart Chain, making off with approximately $36 million. The protocol reports that the breach occurred because an employee’s laptop was compromised.

How the hackers gained access

The attackers managed to obtain three of the six keys of the Gnosis Safe that secures the Hyperlane bridge ProxyAdmin. With this access, they transferred ownership of ProxyAdmin to their own wallet. They then upgraded the bridge contract to a malicious alternative, after which they stole approximately 141.2 million H in a single transaction.

On the Binance Smart Chain, the attack pattern unfolded similarly. The hackers compromised three of five keys in the BSC Safe and carried out the same ProxyAdmin takeover. They then deployed a modified version of the contract with an unlimited minting function. Using this capability, they sent 200,005,000 H directly to their wallet in two steps.

Response and impact on users

Humanity Protocol immediately halted all deposits and withdrawals to the compromised bridges. The team is working with all involved parties, including crypto exchanges, to mitigate the damage. They have also contacted the police to investigate the incident and potentially recover part of the stolen funds.

The protocol feels responsible towards the community and states that it is taking the incident seriously. Users who hold H tokens cannot currently carry out transactions on the affected bridges until the team resolves the situation.

This incident serves as a reminder of earlier security issues in the Ethereum ecosystem. Users should be cautious with their digital assets and apply strong security measures.