Humanity Discloses H Token Dual-Chain Attack Details, With Losses on Ethereum and BSC Exceeding $36 Million
On June 9, according to TechFlow, Humanity released a new statement on the H token security incident, saying that attackers carried out a coordinated attack on related contracts across both Ethereum and BSC on the evening of June 8. The total amount stolen and sold across the two chains has now exceeded $36 million.
According to the project team, the incident was caused by the compromise of an employee’s laptop, which led to the leakage of multiple owner keys for the Gnosis Safe that controlled the Hyperlane bridge ProxyAdmin.
Based on Humanity’s disclosed attack path, the attacker first gained control of the ProxyAdmin on Ethereum and upgraded the contract to a malicious implementation. In a single transaction, the attacker then transferred approximately 141.2 million H tokens. After that, the attacker used a similar method on BSC, taking control of the ProxyAdmin, deploying a malicious implementation with unlimited minting functionality, and minting 200 million H tokens in two transactions before continuing to sell them into the market.
Humanity said it has paused deposits and withdrawals for the related cross-chain bridge and is working with exchanges and law enforcement to investigate the incident. The team also said it is attempting to recover part of the stolen assets.
The core issue in this case is not a traditional bridge exploit in the narrow sense. Instead, the incident highlights the failure of administrative permissions supporting the bridge and token management system. In other words, the attacker obtained the key authority needed to upgrade contract logic, rather than simply gaining access to a normal transfer wallet.
Once the ProxyAdmin and multisig control path were compromised, the attacker was able to directly rewrite token logic through contract upgrades. This allowed the attacker to transfer assets, mint new tokens, and then use on-chain liquidity to sell them.
Different sources have reported different figures, and some details still require official confirmation. Earlier on-chain monitoring and third-party reports cited losses of more than $19 million, $31 million, and $34 million, with different accounts of the number of affected wallets, minted tokens, and selling activity.
However, based on Humanity’s latest statement, the incident has clearly expanded into a dual-chain coordinated attack involving contract upgrades, malicious minting, and token dumping. The full impact is still being clarified as the investigation continues.
Why It Matters
The market impact of this type of incident lies first in permission risk, rather than a single smart contract vulnerability. Even when a project uses multisig, cross-chain infrastructure, and upgradeable contracts, weaknesses in administrator key management can still allow attackers to bypass surface-level security designs and directly rewrite asset logic.
For projects that rely on bridges, proxy contracts, and multi-chain issuance, this incident raises the market’s requirements for operational security, key custody, and separation of upgrade permissions.
Second, a dual-chain token dumping event can directly disrupt pricing anchors across exchanges and on-chain markets. When the same asset trades across different chains, liquidity pools, and centralized platforms at the same time, continuous selling of stolen or newly minted tokens can amplify price discovery confusion, drain liquidity, and distort cross-market spreads.
Some key data points remain inconsistent at this stage. Further disclosure from Humanity, trading platforms, and on-chain security firms will be needed to clarify the full scope of the incident.
WEEX View
The core market question is no longer simply whether Humanity was hacked. The real issue is whether the stolen and newly minted H tokens can continue moving through market infrastructure and trigger a second round of forced clearing.
For CEXs, the first-line impact usually appears in three areas: whether deposits and withdrawals remain isolated, whether spot and derivatives pricing begin to depeg, and whether market makers are still willing to provide two-sided liquidity.
If tainted on-chain tokens continue flowing into external addresses while platforms have not completed address profiling and risk control synchronization, arbitrage traders may be the first to step in and capture spreads. But these spreads come with liquidation, freeze, and compliance risks, leaving very little safe room for execution.
The more practical business conflict is also clear. The project team wants to secure pauses, freezes, and recovery cooperation. Exchanges care more about asset tradability, user exposure, and potential compensation disputes. Market makers will quickly reassess inventory value and hedging costs.
If on-chain spot prices, cross-chain mapped token prices, and CEX derivatives prices remain split for too long, H could enter a fragmented “same name, different price” state. In that environment, institutional capital and high-frequency liquidity usually withdraw first, leaving behind a high-friction and low-depth risk market.
The next four variables are the most important to watch. First, whether Humanity discloses the affected contracts, the number of leaked keys, and a complete remediation plan. Second, whether exchanges expand quantitative risk controls, including freezing suspicious deposits, adjusting leverage parameters, or delisting related trading pairs. Third, whether any residual malicious permissions remain on BSC or Ethereum. Fourth, whether the team can provide a verifiable supply repair and circulating supply reconstruction plan.
As long as any of these remain unclear, liquidity recovery is likely to be slow, while arbitrage, liquidation, and legal recovery efforts continue to pressure each other.
Timeline
- 2026-06-07: Humanity Protocol announced the launch of staking and supported cross-chain deposits through its official bridge.
- 2026-06-08 23:59: Early monitoring indicated that wallets related to Humanity may have been attacked, with more than 17 wallets affected and reported losses initially exceeding $19 million.
- 2026-06-09 00:34: On-chain monitoring later suggested that losses from related addresses had exceeded $31 million, and the attacker began swapping H tokens for ETH.
- 2026-06-09 09:36: Further monitoring showed that the attacker was still minting and selling H tokens on BSC, with cumulative proceeds reported at around $34 million.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like

$7.6 Trillion AI Infrastructure Investment Pressures Hyper-scalers' Cash Flow

Hyperliquid opens low-latency data access under $1K

What is revenge trading? The trading minute

Circle vs OUSD: The Battle Between Open Standard (OUSD) and Floating Reserves of Stablecoins

Iore Acquires Cryptocurrency HYPE, First Acquisition by a Listed Company in Japan

Being Long 50x Results in $2M Profit: How Did the Hyperliquid 'Insider' Pull It Off?

Machine-Native Trading: Current Status and Missing Infrastructure

PayPal launches PYUSDx after $100M milestone

Japan is Dragging the World Down

Robinhood Invests in Crypto.com and OG.com to Expand Prediction Market Trading Infrastructure

Don't Just Focus on the Fed! Coin Metrics Reveals the Real 'Turning Point Code' for Bitcoin: Non-Farm Payrolls Have the Biggest Impact, Core CPI is More Persistent

Tether is pushing USDT into a cracking $3 trillion Wall Street debt machine as defaults hit five-year highs at major funds

263,000 New Solana Tokens in One Day, But None Have Been Traded Yet

BCA Macro Outlook: How Much Longer Can U.S. Stocks Rise? The AI Investment Cycle May Only Have Completed Two-Thirds

Why Pokémon Cards Could Become the Currency of the Apocalypse

Digital Asset Financial Innovation Seminar Concludes

Virtual Asset ETFs Should Be Introduced Gradually Starting with Spot ETFs

TOKEN2049 Singapore 2026: Tickets, Program, and -10% Cointribune

Economy: Elon Musk Promises AI and Robots Will More Than Double Global GDP in 10 Years

Reassessing NEAR's Investment Logic: Has Trading Volume Taken Off, and Can Token Value Keep Up?

Coinbase expands AI access to stocks and crypto

Laptop Coin vs TRUMP Meme Coin Price: What Two Crashes Say About Political Meme Coins
Laptop coin crashed 98% in under an hour, while TRUMP took nineteen months to fall the same distance, the real link between them is the buyers, not the timeline.

Hyperliquid OI Hits $14.3B as HYPE Reaches New Highs — What It Means for WEEX Traders
Hyperliquid is entering a new phase of growth. Open interest on the on-chain derivatives platform has climbed to $14.3 billion, HYPE has hit a new all-time high, and new financial products are beginning to build on top of its trading infrastructure. At the same time, regulatory attention is rising, with the CFTC exploring how platforms like Hyperliquid could fit within a compliant market structure.

Unicoin takes Uniswap to court over UNI trademark dispute

NVIDIA expands Australia AI capacity with 8 partners

BCE, PPI: The Two Events Shaping Inflation

VerifiedX launches $15M Bitcoin funding round

WEEX Auto Earn: Turn Idle Crypto Into Daily Passive Income, No Lock-Up Required
WEEX, a global multi-asset trading platform, has announced the launch of WEEX Auto Earn, a new passive-income feature that allows standard users to earn up to 100% APR (7-day exclusive for new users) on idle USDT held across their funding, futures, and spot accounts.

The Era of AI Spending Money... Will Stablecoins Become the Payment Network for the 'Agent Economy'?






