Humanity Protocol revealed that attackers had compromised several administrative keys, and taken control of infrastructure on Ethereum and BNB Smart Chain. This led to the theft of more than $36 million in H tokens.
You can read more about it here:
- Humanity Protocol says that hackers compromised the administrative keys to its Ethereum Smart Chain and BNB Smart Chain Infrastructure, stealing more than $36 million.
- According to the project, the attack began when an employee’s laptop was compromised. This allowed attackers access to bridge controls on BNB Smart Chain and 200,000,000 H tokens.
- Humanity Protocol, in collaboration with the exchanges and authorities involved in recovery efforts, has suspended all deposits and withdrawals from affected bridges.
Humanity Protocol’s incident report for June 9, 2009, states that the attack began after a laptop of an employee was compromised. This allowed the attacker access to keys tied to bridge administration system systems.
This disclosure is an extension of a previous statement by Humanity CEO Terence Kwok who confirmed that the private keys belonged to a Humanity Foundation Member were compromised.
The Humanity bridge, and its related liquid pools were warned to be avoided while an investigation took place.
Compromise bridge controls enable token theft
Humanity Protocol released information that revealed three of the six Gnosis Safe owners keys for Hyperlane’s bridge ProxyAdmin, which is run on Ethereum. These keys were compromised. These credentials allowed the attacker to move ownership of ProxyAdmin to an account under their control and upgrade the bridge to malicious code. They also moved 141.2 million H tokens through a single transaction.
On BNB Smart Chain the attacker compromised 3 of 5 Safe keys, and also took control of ProxyAdmin’s contract. Humanity Protocol reported that the attacker deployed a malicious code containing a minting function with an unlimited limit and generated 200,000,005 tokens H in two transactions.
On the 9th of June, Specter on-chain analysts reported that Humanity Protocol wallets had been drained. Initial estimates estimated losses to be around $19,000,000 before blockchain trackers increased the number above $30,000,000.
Specter cited blockchain monitoring data that showed the attacker had sold a part of his stolen tokens, and then converted a percentage of those proceeds to Ethereum. According to an analyst’s Telegram message, approximately $23.7million had been converted into ETH while $7.9million remained in the H tokens.
Blockaid, a separate monitor, had reported that an attacker had obtained administrator proxy rights for BNB Smart Chain. He also claimed to have minted over 100,000,000 H tokens. Humanity Protocol did not confirm that claim when it was made, but the most recent incident report has confirmed the attacker’s administrative control over the BNB Smart Chain and the minting of 100 million H tokens.
Working with law enforcement and exchanges
Humanity Protocol’s latest statement said that deposits and withdrawals from the bridges affected have been stopped while efforts to respond continue.
It said the project is working with other parties and exchanges in order to limit further damages. Humanity Protocol, in addition to an internal investigation and working with the police authorities on the case of thefts and the recovery of some funds, said that it was also conducting an external investigation.
“We know words can’t fix this, but we’re going to show up, keep you in the loop, and do the work to earn back the trust you placed in us. We’re not going anywhere and are still continuing to build.”
Kwok explained that before the technical breakdown of the last update was released, the team worked with specialists in security and partners for exchange. At that time, no reimbursement plans or recovery frameworks had been announced.
The market reaction was harsh, and the native token of the protocol fell by over 90%.
Source: crypto.news
Humanity Protocol is a network of identity based on zkEVM that verifies users using palm biometrics, zero-knowledge verifications and other methods. Personal information about the user’s identity will not be stored in central databases.
Once the investigation has progressed, a complete postmortem report is expected to be made public.
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: crypto.news
