One of crypto’s most anticipated decentralized identity projects is in crisis today. Humanity Protocol, the palm-scan-based digital identity network that raised $50 million from backers including Jump Crypto, Hex Trust, and Kingsway Capital, was drained of more than $36 million on Monday night after attackers compromised a foundation member’s private keys and took control of its cross-chain bridge infrastructure.

The attack unfolded across Ethereum and BNB Chain simultaneously, with the theft still in progress as of Tuesday morning. On-chain analyst Specter was among the first to flag the breach, noting that hundreds of addresses holding H tokens were being continuously targeted.

How the Attack Unfolded

In a public statement posted to social media on Tuesday, Humanity Protocol confirmed the attack originated when an employee’s laptop was compromised, giving attackers access to private keys with administrative privileges over the project’s bridge contracts. Once inside, the attackers moved on two fronts: dumping stolen H tokens for ether on the open market, and minting additional H tokens on BNB Chain — a double-pressure attack that accelerated the token’s collapse.

At its low, the H token briefly touched $0.05, representing a decline of over 92% from its Monday price. On-chain data confirmed that approximately $9 million had already been swapped for ETH, with another $9.9 million remaining in H tokens as of Tuesday morning.

The Broader Pattern: Keys, Not Code

The Humanity breach is the latest and most painful illustration of what has become the dominant attack vector in DeFi this year. Attackers are no longer hunting for subtle flaws buried in smart contract code. Instead, they are targeting the humans who hold administrative keys — and the devices those keys live on.

The Humanity hack fits squarely into a year that has already produced two nine-figure key-based heists. Solana exchange Drift lost approximately $285 million in April after a North Korean hacking group spent six months socially engineering access to an administrative key. That same month, Kelp DAO lost roughly $292 million through a single-validator bridge compromise. The pattern is unmistakable: in 2026, the biggest losses come from stolen keys rather than flawed code.

2026’s Worst DeFi Hacks at a Glance

What Comes Next

The timing of the attack adds a further layer of jeopardy for the project. According to blockchain data platform Tokenomist, Humanity Protocol is due to unlock 266.5 million H tokens — roughly 9.4% of its released supply, worth approximately $33 million at pre-crash prices — on June 25, across six allocations that include the foundation treasury and a strategic reserve. That looming unlock threatens to pile additional selling pressure on an already-devastated token price.

As of publication, Humanity Protocol founder Paul Kwok stated the team is working with security experts and exchange partners but offered no details on a user compensation plan. With over $885 million lost to DeFi hacks in the first six months of 2026 alone, the industry faces growing pressure to treat key management and operational security as first-class engineering problems — not afterthoughts.