DeFi identity token suffers $32M exploit

TLDR

Humanity Protocols H identity token was hit by a private key exploit that drained more than $30 million and caused an 80 to 90 percent crash.

1. Humanity Protocol, a biometric DeFi identity project, lost roughly $32 to $36 million after attackers gained admin key access and drained at least 17 wallets.
2. The H token collapsed over 80 percent as the attacker minted extra H on BNB Chain and dumped into ETH and BNB, exposing serious governance and key management failures.
3. Investigators are probing whether this was pure external theft or a possibly staged insider event, and a large upcoming unlock could add more selling pressure and uncertainty.

Deep Dive

1. How The Exploit Unfolded

Humanity Protocol (H), a palm scan based decentralized identity project, reported that attackers compromised private keys tied to a Humanity Foundation member and took control of bridge and admin wallets. According to several reports, at least 17 project linked wallets were emptied for more than $32 million, with some estimates near $36 million across Ethereum and BNB Chain. The attacker drained existing H holdings and used admin control to mint large amounts of new H, then swapped much of it into ETH and BNB as documented by on chain trackers and outlets like CoinDesk and Decrypt.

2. Market Impact On H And Identity Tokens

H fell from about $0.67 to near $0.13 and briefly as low as roughly $0.05, an intraday drop around 80 to 90 percent, as stolen and freshly minted H was dumped into thin liquidity. On BNB Chain, the attacker minted around 100 to 200 million extra H, with reports that over 18,000 ETH plus BNB were extracted while a large H stash still sits unsold, effectively capping recovery potential. For the broader DeFi identity narrative, this shows how a single key or small multisig controlling minting and bridges can erase months of progress in hours.

3. Motives, Allegations, And What To Watch

Pseudonymous investigator ZachXBT has publicly called the incident possibly staged, pointing to the ability to mint on a second chain and aggressive prior market making, though no independent proof of an inside job has emerged. The team says it is working with security firms, exchanges and law enforcement, and has asked users to avoid the bridge and liquidity pools until a full post mortem is published. Reports also flag a significant H unlock later in June, which, if it proceeds on schedule, could add more supply into an already damaged market if confidence is not restored.

Confidence: high because multiple independent crypto news outlets and on chain analysts agree on timing, method and loss range, while only the question of insider intent remains disputed.

Conclusion

A compromised admin key at Humanity Protocol turned a high profile DeFi identity token into a rapid wealth drain, with over $30 million lost and H down more than 80 percent. The episode underscores that in key controlled systems, operational security and transparent governance are as important as code audits, especially when bridges and minting powers are involved. For DeFi users, identity tokens and other admin heavy projects now warrant closer scrutiny of who controls keys, how multisigs are structured and what happens around large unlocks or cross chain deployments.