Humility Protocol Suffers $36M Theft via Bridge Exploits

ChainCatcher report: Humility Protocol has issued a security incident update on X, stating that yesterday, H tokens on the Ethereum and BSC chains suffered a coordinated attack, with over $36 million in assets confirmed stolen and sold. Preliminary investigations indicate that the incident originated from a compromised employee computer, resulting in the exposure of private keys for the multisignature wallet controlling the Hyperlane Bridge ProxyAdmin. The attackers gained access to three of the six signers' private keys for the Gnosis Safe on Ethereum, transferred ownership of the ProxyAdmin to a wallet under their control, and upgraded the bridge contract to a malicious implementation, subsequently transferring approximately 141.2 million H tokens in a single transaction. Meanwhile, the attackers also gained control of three of the five signers' private keys for the Safe wallet on BSC, took over the ProxyAdmin in the same manner, and deployed a malicious contract with infinite minting capabilities, minting 200 million H tokens in two separate transactions to their own wallet. Humility has suspended all deposits and withdrawals for the affected bridge services and is collaborating with exchanges and other partners to minimize losses. The team is also cooperating with law enforcement on the investigation and attempting to recover部分stolen funds.