ZachXBT rules out insider theft in Humanity Protocol’s $31M exploit

Humanity Protocol’s $31 million exploit has been linked to a genuine private key compromise rather than an insider theft scheme, according to a new assessment from on-chain investigator ZachXBT.

According to ZachXBT, further analysis of the stolen funds has led him to conclude that the attack and earlier concerns about suspicious market activity surrounding Humanity Protocol’s H token were separate events.

The investigator said evidence now points away from the theory that the project team orchestrated the exploit themselves.

The update follows a June 9 security incident that wiped out more than 80% of H’s value after attackers drained wallets connected to the project and sold large amounts of the token on the open market.

In comments posted on X, ZachXBT said he initially considered whether the reported private key compromise could have been used to cover up token sales by insiders. However, after examining the laundering activity linked to the stolen funds, he said the evidence supported Humanity Protocol’s explanation that a private key belonging to a Humanity Foundation member had been compromised.

“I thought that initially due to the active MM recent OTC before unlocks however the evidence shared points to otherwise,” ZachXBT wrote in response to a user who questioned whether the breach could have been used as an excuse to justify dumping the token.

Questions remain over market-making activity before token unlock

Even as he dismissed the self-theft theory, the investigator continued to raise concerns about trading activity that occurred before the exploit.

Earlier comments from ZachXBT alleged that H had been aggressively pushed higher for weeks despite what he described as a lack of fundamental developments. He also called on Humanity Protocol to disclose details of market-making agreements involving a Hong Kong-based entity.

A later update clarified that what he described as “sketchy” market-making activity, over-the-counter transactions, and the private key compromise appeared unrelated. According to his analysis, the token’s unusual price action before the attack should not be viewed as evidence that the team was involved in the theft itself.

Instead, ZachXBT suggested that hackers may have benefited from an already elevated token price after the market value of H climbed sharply ahead of a scheduled token unlock later this month.

Humanity Protocol is set to release additional tokens on June 25 under a revised investor vesting plan. As previously reported by crypto.news, some early backers opted for a discounted immediate unlock rather than a longer vesting schedule.

Humanity Protocol founder and CEO Terence Kwok confirmed on June 9 that private keys belonging to a Humanity Foundation member had been compromised. At the time, Kwok urged users not to interact with the project’s bridge or liquidity pools while security teams investigated the incident.

On-chain analyst Specter initially reported that more than 17 wallets linked to Humanity Protocol had been drained. Early estimates placed losses near $19 million before later blockchain tracking pushed the figure above $30 million.

Data tracked by blockchain investigators showed the attacker selling H tokens and converting a large portion of the proceeds into Ethereum. Specter reported that roughly $23.7 million had been swapped into ETH, while about $7.9 million remained in H.

Separate monitoring from Blockaid later alleged that the attacker obtained proxy administrator rights over the H token contract on BNB Smart Chain and minted 100 million additional tokens. Humanity Protocol had not confirmed that claim at the time of reporting.

The exploit erased most of the token’s rally from earlier in June. After reaching an all-time high near $0.844 on June 2, H fell to around $0.123 during the sell-off as trading volume surged above $605 million.