Humanity released a security incident investigation report, the main network bridge was not affected, and the attack tools and methods have characteristics of North Korean hackers

Humanity announced an independent investigation report by Quantstamp, which disclosed that in the H token security incident, the attacker used tools and methods characteristic of North Korean hackers, disguising themselves as communication from the Bithumb exchange through phishing emails, inducing project directors to click on malicious attachments, thereby deploying a remote control Trojan on their devices, ultimately gaining full desktop control and wallet private keys. Subsequently, they launched on-chain attacks on Ethereum and BNB Chain: on the Ethereum side, they stole keys to upgrade contracts and transferred approximately 141.18 million H tokens, while on the BSC side, they took over the ProxyAdmin contract and minted new tokens. The stolen assets were then continuously sold on Uniswap and PancakeSwap for about 8 hours, causing significant impact on liquidity and market prices.

Currently, the H token contract on the Ethereum side has been frozen, the mainnet bridge is unaffected, but the BSC deployment has been controlled by the attacker and still has minting permissions. The team is working with exchanges and security parties to advance subsequent disposal and recovery plans, while reminding users to be wary of false "compensation/claim" links, and stated that they will release further updates through official channels. Previously, it was reported that the Humanity Protocol was attacked, resulting in the leakage of a private key from a member of the Humanity Foundation, leading to over 31 million dollars in funds being stolen.