Humanity Protocol $36M hack linked to North Korean hackers

A sophisticated phishing attack has compromised the decentralized identity project Humanity Protocol, leading to the theft of approximately $36 million worth of its H tokens. Blockchain security firm Quantstamp, which investigated the incident, attributes the breach to hacking groups linked to North Korea.

The attack began on June 5 when a project director received a phishing email disguised as a legitimate token lockup schedule update from the South Korean cryptocurrency exchange Bithumb. Opening a malicious attachment in the email installed remote-access malware on the director's laptop, granting the attackers full control of the device without triggering endpoint security protections. From there, the attackers copied wallet credentials and private keys, including seven keys stored on the machine that provided administrative access to critical project infrastructure.

Using these stolen credentials, the attackers executed on-chain transactions on June 8. They upgraded a contract on the Ethereum network and removed roughly 141 million H tokens from the project's bridge. Simultaneously, they seized proxy administrator privileges on the BNB Smart Chain, allowing them to mint an...