Humanity Protocol disclosed that the approximately $31 million attack on June 8 was caused by a developer’s device being infected with malware. The attackers subsequently gained root access to the device and obtained seven private keys that were accidentally backed up locally during the mainnet launch.
Involves seven critical private keys
The project team stated that these private keys include one administrator hot wallet private key and six Safe owner private keys distributed across Ethereum and BNB Chain. The attacker did not exploit a code vulnerability but instead used valid private keys to authorize transactions and transfer assets.
The project states that it is not a contract vulnerability.
According to the disclosure, this incident does not involve exploitation of a smart contract vulnerability. The issue stemmed from operational and access control procedures, particularly regarding key backups, endpoint security, and permission management during the mainnet launch.
Operational security risks are escalating
Since attackers used legitimate private keys, this type of risk is typically difficult to detect in advance through contract audits. The incident has once again made private key management, development environment isolation, and infrastructure security key priorities for crypto projects.