Humanity Protocol, a biometric blockchain identity project that had been one of crypto’s top-performing tokens of 2026, suffered a catastrophic security incident on June 9 in which attackers drained approximately $32 million from more than 17 wallets — sending the H token crashing 90% within hours — before on-chain investigator ZachXBT publicly questioned whether the incident was a genuine external hack or a staged exit by the project’s own insiders.
The attack unfolded in two phases. In the first, attackers minted 100 million H tokens and drained associated wallets, converting approximately $23.7 million into ETH across multiple addresses while leaving roughly $7.9 million in H tokens, per on-chain data flagged by Arkham Intelligence.
In the second phase, the attacker extended the exploit to BNB Chain — taking over the H token’s proxy admin contract and minting an additional 100 million H tokens worth approximately $12.9 million to a fresh wallet, per blockchain security firm Blockaid’s on-chain monitoring of the incident.
Humanity Protocol acknowledged the breach in an official post on X, confirming that private keys belonging to a member of the Humanity Foundation had been compromised. The team urged users to avoid interacting with the bridge or any liquidity pools until further notice, and stated that official updates would come only from the main account or co-founder Terence Kwok’s personal account, per the @Humanityprot post — one of your provided sources.
ETH's price sees some gains on the daily chart. Source: ETHUSD on Tradingview
ZachXBT’s Three-Post Takedown On The Crypto Hack
The incident might have passed as a conventional private key compromise had ZachXBT not weighed in within hours. In three posts on X the pseudonymous on-chain investigator systematically dismantled the team’s narrative.
In his first post, ZachXBT noted that the picture was unclear — it could be a hack or a deliberate rug — but flagged that the H team appeared to be working with an active market maker given the concentrated token supply, and that all H tokens were sold on DEXs rather than centralized exchanges — an unusual pattern for an external attacker seeking liquidity.
In his second post, he sharpened the assessment: “The incident seems possibly staged. I am not buying the team’s story. It’s a convenient way for the active MM to have exited.” In his third post, he turned to the project’s broader credibility: “You choose to crime pump your token for weeks with zero fundamentals and think CT will blindly trust your story? Disclose your active MM agreements with the HK entity first.”
ZachXBT later walked back some of his concerns after additional analysis suggested the private key compromise and market-making issues may be unrelated — but the damage to the project’s credibility was already done.
The Context That Made ZachXBT’s Suspicions Land
The timing of the incident carries its own weight. The H token had surged approximately 875% above its 2026 low before the crash, per BanklessTimes — making it one of the year’s most extreme performers in a sector not short of extreme performers. A token unlock is scheduled for June 25 — two weeks away — a timeline that would make a staged exit before unlock a financially rational, if criminal, decision.
Three of the project’s four co-founders have documented histories involving lawsuits, financial fraud allegations, and management failures. Reports citing internal conversations suggested only approximately one million of the project’s nine million registered identities had completed biometric verification — the core metric on which Humanity’s entire value proposition rests.
This development marks a critical and deeply familiar moment for the nascent sector. A 90% token crash tied to a private key compromise that crypto’s most respected on-chain investigator publicly questions as staged — arriving weeks before a major token unlock, involving a project whose leadership carries documented red flags — is precisely the pattern that has defined the sector’s most damaging fraud cases.
Whether ZachXBT’s suspicions ultimately prove correct will depend on on-chain evidence still being gathered. What is already clear is that $32 million is gone and the community that trusted Humanity Protocol’s identity narrative is left with nothing but questions.
Cover image from Grok, ETHUSD chart from Tradingview
