On-chain sleuth ZachXBT has ruled out the possibility of an inside job in the $31 million exploit of Humanity Protocol, attributing the breach to a genuine private key compromise.
According to ZachXBT, deeper analysis of the stolen funds led him to conclude that the attack and earlier concerns about suspicious market activity around the H token were separate events. He initially considered whether the reported private key compromise could have been used to cover up insider token sales, but after examining the laundering activity tied to the stolen funds, evidence supported Humanity Protocol's account that a private key belonging to a Humanity Foundation member had been compromised.
“I thought that initially due to the active MM & recent OTC before unlocks however the evidence shared points to otherwise,” ZachXBT wrote in response to a user who questioned whether the breach could have been an excuse to justify dumping the token.
Market-Making Activity Separated from Hack
Even as he dismissed the self-theft theory, ZachXBT continued to raise concerns about trading activity before the exploit. Earlier comments alleged that H had been aggressively pushed higher for weeks despite a lack of fundamental developments. He also called on Humanity Protocol to disclose details of market-making agreements involving a Hong Kong-based entity.
A later update clarified that what he described as “sketchy” market-making activity, OTC transactions, and the private key compromise appeared unrelated. According to his analysis, the token's unusual price action before the attack should not be viewed as evidence that the team was involved in the theft. Instead, ZachXBT suggested that hackers may have benefited from an already elevated token price after the market value of H climbed sharply ahead of a scheduled token unlock later this month.
Humanity Protocol is set to release additional tokens on June 25 under a revised investor vesting plan. As previously reported, some early backers opted for a discounted immediate unlock rather than a longer vesting schedule.
Exploit Details: 17 Wallets Drained, Losses Exceed $30M
Humanity Protocol founder and CEO Terence Kwok confirmed on June 9 that private keys belonging to a Humanity Foundation member had been compromised. At the time, Kwok urged users not to interact with the project's bridge or liquidity pools while security teams investigated the incident.
On-chain analyst Specter initially reported that more than 17 wallets linked to Humanity Protocol had been drained. Early estimates placed losses near $19 million before later blockchain tracking pushed the figure above $30 million. Data tracked by blockchain investigators showed the attacker selling H tokens and converting a large portion of proceeds into Ethereum. Specter reported that roughly $23.7 million had been swapped into ETH, while about $7.9 million remained in H.
Separate monitoring from Blockaid later alleged that the attacker obtained proxy administrator rights over the H token contract on BNB Smart Chain and minted an additional 100 million tokens. Humanity Protocol had not confirmed that claim at the time of reporting.
The exploit erased most of the token's rally from earlier in June. After reaching an all-time high near $0.844 on June 2, H fell to around $0.123 during the sell-off as trading volume surged above $605 million.