Humanity: Developing Fund Recovery or Compensation Plan, and Token Contract Upgrade Plan

On June 9, Humanity released an update regarding the recent attack incident, clarifying that this was not a smart contract exploit. No vulnerabilities were found in the bridge, core token contracts, or the Safe system. All actions executed by the attacker—including token transfers, Safe transactions, and proxy contract upgrades—were authorized through legitimate private keys. The root cause of the attack was solely key leakage, stemming from insecure key management practices: the private key used for production environment signatures was backed up on a standard general-purpose development machine, with no isolated hardware-based protection in place. This is a human and operational security oversight. To date, Humanity remains in the process of investigating the exact breach method and the specific timeline of the attacker’s unauthorized access. We have already engaged external security experts to conduct a forensic examination of the compromised devices. As the investigation progresses, Humanity will share further updates with the community. Additionally, Humanity is developing a fund recovery and compensation plan for affected users, alongside a token contract upgrade plan—both will be promptly disclosed once all details are finalized.