TLDR Tech / InfoSec
Humanity Protocol H Token Compromise: One Email, $36M Lost, 89% Crash
A phishing email impersonating Korean exchange Bithumb carrying a malicious attachment delivered remote-access malware to the Windows machine of director Chong Yee Wai and extracted the private keys he controlled for on-chain operations. With those keys, the attacker simultaneously replaced the implementation of a Hyperlane warp-route proxy on Ethereum to redirect approximately 141.18 million $H tokens, and used three stolen BSC Safe signer keys to seize ProxyAdmin ownership and mint 100 million additional $H tokens, conducting both chains in parallel to foreclose any single-chain defensive response. The attacker liquidated proceeds through Uniswap and PancakeSwap over roughly eight hours, crashing $H by 89% and generating at least $21 million in confirmed ETH proceeds. The breach reinforces that no smart contract audit mitigates an admin keyholder opening a zip file on a personal device, and protocols should enforce hardware security modules, multisig key ceremonies with geographically separated signers, and administrative key isolation from internet-connected endpoints.
Read the full story