Humanity Protocol's $32M Hack Raises Questions About Private Key Controls

The Incident and Token Collapse

Humanity Protocol suffered a security breach on June 9 in which attackers drained approximately $32 million across more than 17 wallets. The H token declined 76% to 90% in the hours following the incident, according to different reports, from what had been one of crypto's top-performing tokens in 2026. The sharp collapse raised immediate questions about the protocol's security posture and the authenticity of the attack.

Questions Over Attack Legitimacy

On-chain investigator ZachXBT publicly questioned whether the hack was staged, publishing evidence to support his skepticism. The investigator's analysis pointed toward bridge-admin custody arrangements as a potential weak point, suggesting that private keys controlling significant protocol assets may have been held in a manner inconsistent with the protocol's core pitch: zero-knowledge identity verification with strong key control. Neither the protocol team nor ZachXBT has provided a definitive explanation for the discrepancy between the two reported token declines, though the spread from 76% to 90% reflects the rapid price deterioration across exchanges during the incident.

Unresolved Custody and Control Issues

The incident has left fundamental questions unresolved about how Humanity Protocol manages private keys and admin functions, particularly in relation to cross-chain bridges. For a protocol built on biometric identity and trustless key management, the apparent centralization of critical admin access—and the failure to prevent or quickly recover from the loss—undermines confidence in its core value proposition. As of June 10, the protocol had not publicly disclosed full details of the attack vector or confirmed the status of remaining assets.