North Korea linked hackers steal $36M tokens

TLDR

North Korea linked hackers are reported to have stolen around 36 million dollars in tokens from Humanity Protocol after compromising multiple private keys.

1. The theft hit Humanity Protocols H token, with attackers using stolen admin keys to move and mint tokens across Ethereum and BNB Chain, causing a sharp price collapse.
2. A Quantstamp investigation found tooling typical of DPRK threat actors, fitting a broader pattern of North Korea linked groups targeting DeFi via social engineering and key compromise.
3. The case highlights that governance keys and operational security are now prime attack surfaces, so users and projects need to scrutinize key management, bridges, and admin powers.

Deep Dive

1. How The 36M Theft Happened

Humanity Protocol disclosed that roughly 141 million H tokens were drained and additional tokens minted on BNB Chain, with total losses estimated around 36 million dollars in value in a June incident. A security report cited in a June 13 write up explains that attackers gained control of seven private keys stored on a malware infected developer machine, including an admin hot wallet and multiple Safe owner keys on Ethereum and BNB Chain, then used those keys to upgrade contracts, move bridge funds, and mint new H tokens on BNB Smart Chain, selling most into ETH and liquidity pools, which triggered an 80 to 90 percent crash in Hs value. The team later froze the Ethereum token contract via a clean multisig while declaring the BNB Chain deployment permanently compromised and abandoned, since the attacker retains minting control there, as described in a follow up post mortem.

2. North Korea Link And Track Record

Quantstamps investigation, summarized in a detailed disclosure, said the malware tooling and certificate signing behavior were characteristic of DPRK linked intrusions, although it stopped short of a fully definitive attribution. Separately, a quarterly review of DeFi hacks notes that other major 2026 attacks, such as the Drift Protocol incident, have been attributed to North Koreas Lazarus Group and that three of the four largest Q2 exploits came from operational or infrastructure failures rather than code bugs. Taken together, this supports the view that North Korea aligned operators increasingly favor phishing, social engineering, and key theft to extract funds from DeFi and bridge infrastructure.

3. Risk Lessons For Users And Projects

For projects, the key lesson is that admin and multisig keys should never live on internet exposed workstations; hardware wallets, dedicated signing devices, and strict access separation are now baseline, not nice to have. For users, the Humanity case shows why it is important to understand who controls upgrade and minting powers, how bridges are governed, and whether a team can credibly migrate or freeze contracts after an incident. Sector wide data showing about 70 exploits and 746 million dollars stolen in DeFi in Q2 2026, with most large incidents driven by operational failures, suggests this is a structural risk, not a one off.

Conclusion

The Humanity Protocol hack illustrates how a single compromised machine holding multiple keys can translate into tens of millions of dollars in losses without any exploitable bug on chain. Evidence pointing to North Korea linked tooling fits a broader shift toward sophisticated social engineering and key theft against DeFi and bridges. Going forward, the projects that invest in hardened key management and transparent governance are likely to be meaningfully safer environments for capital than those relying only on code audits.