Humanity Hack Update: Suspected North Korean Hackers Involved, About 141 million Tokens Stolen and Dumped

June 14 — The Humanity Project team issued a statement in the early hours of yesterday regarding a cross-chain attack targeting its H token that took place on June 8. The attacker used a phishing email to gain access to a board member’s device, stealing their private key to execute on-chain transactions. The report noted the attack displayed technical tactics and tooling similar to those linked to a North Korean hacker group. The breach occurred across both Ethereum and BNB Chain. Using the stolen key, the attacker upgraded the Ethereum contract and transferred roughly 141.18 million H tokens. Simultaneously, they seized control of the BSC-side ProxyAdmin contract and minted additional tokens. Over an approximately 8-hour window, the attacker gradually sold these assets on Uniswap and PancakeSwap, disrupting liquidity and harming token holders. The project team confirmed the attack vector was a targeted social engineering phishing email disguised as an update notification from crypto trading platform Bithumb. The victim was tricked into opening a malicious attachment, which installed a remote access trojan that granted full device control, enabling theft of wallet data and private keys. As of the latest update, the Ethereum-side H contract has been frozen via an unaffected multi-signature (multi-sig) mechanism. However, the BSC-side deployment remains under the attacker’s control, leaving open the potential for additional minting. The team is collaborating with exchanges and stakeholders to develop fixes and remedies, and advised users to stay on alert for phishing links and scam messages.