Worked example · 2026-06

Humanity Protocol ($H) — single developer-machine compromise defeats two multisig quorums across two chains — Ethereum + BNB Chain — 2026-06-08/09

Loss: ~$32M–$36M realised. A single compromised developer machine yielded seven private keys that the attacker used to execute a coordinated cross-chain attack against Humanity Protocol's $H token on Ethereum and BNB Smart Chain. Three breach vectors composed: (1) an admin hot-wallet key was used to directly steal ~6,000,000 $H; (2) on Ethereum, the attacker controlled three of the six owners of the Gnosis Safe that held the bridge's ProxyAdmin, transferred Safe ownership, upgraded the bridge contract to a malicious implementation, and drained ~141,000,000 $H in a single transaction; (3) on BNB Smart Chain, the attacker controlled three of the five owners of the corresponding Safe, seized the ProxyAdmin, upgraded the token contract, and executed mints totalling ~300,000,000 new $H. In aggregate ~447,000,000 $H were stolen or minted. The token collapsed ~80–90% within hours (from ~$0.70 to ~$0.05–$0.07). The realised dollar figure is bounded by DEX liquidity depth as the attacker sold stolen and minted $H for ETH — the nominal 447M-token event is far larger than the ~$32–36M realised, the standard notional-vs-realised gap OAK records for mint-and-dump events.
OAK Techniques observed: OAK-T15.003 (Operator-Endpoint Compromise — the load-bearing entry vector: malware on one developer machine harvested seven private keys that had been backed up / present on the infected host. Humanity's own post-mortem states "this was not a smart contract exploit — all actions used legitimately authorized private keys." The developer-workstation-as-key-store sub-shape is the Radiant Capital / Concentric Finance pattern. See techniques/T15.003-operator-endpoint-compromise.md). OAK-T11.011 (Multi-chain Key-store Co-location — the architectural amplifier: the seven keys co-located on a single host spanned an Ethereum hot wallet, a quorum of the Ethereum ProxyAdmin Safe signers, and a quorum of the BSC ProxyAdmin Safe signers — so one endpoint compromise produced simultaneous extraction across two chains with no per-chain isolation. This is the canonical T11.011 signature applied at the protocol-multisig-signer-key layer rather than the exchange-hot-wallet layer. See techniques/T11.011-multi-chain-key-store-co-location.md). OAK-T6.005 (Proxy-Upgrade Malicious Switching, operator-key-compromise sub-class — on both chains the on-chain extraction primitive was a ProxyAdmin → upgradeTo to attacker-controlled implementation: the bridge contract on Ethereum and the token contract on BSC were each legitimate audited deployments until the moment the compromised quorum upgraded them. See techniques/T6.005-proxy-upgrade-malicious-switching.md). OAK-T9.004 (Access-Control Misconfiguration — after the BSC token-contract upgrade the attacker held an open mint capability and minted ~300M $H with no cap, timelock, or independent authorisation; the structural precondition was that the multisig's nominal 3-of-N threshold was the only circuit-breaker on supply-affecting authority. See techniques/T9.004-access-control-misconfiguration.md). OAK-T5.001 (Hard-LP-Drain / downstream dump — stolen and minted $H were sold against on-chain liquidity for ETH, collapsing the token ~80–90%. See techniques/T5.001-hard-lp-drain.md). The combination T15.003 → T11.011 → T6.005 → T9.004 → T5.001 is the canonical OAK chain for one-endpoint-compromise → co-located multi-chain signer quorum → malicious upgrade → unbounded mint → dump.
Attribution: pseudonymous. On-chain addresses were identified by multiple firms; the root cause (malware-induced compromise of a single developer machine holding seven keys) is confirmed by Humanity Protocol's own post-mortem and corroborated by independent researchers. Quantstamp publicly linked the breach to North-Korea-tied actors, but disclosed no supporting forensic evidence (no on-chain cluster overlap, no named implant family, no TTP detail), and independent researchers were skeptical that state-sponsored involvement was established. OAK therefore records the attacker as pseudonymous and treats the DPRK linkage as an unsubstantiated single-firm assessment rather than an OAK-G01 attribution; the case would require corroborating cluster evidence before promotion to an inferred-strong Lazarus mapping. The Ethereum bridge drain (~141M $H) is timestamped to 2026-06-08; the post-mortem and continued mint-and-dump activity ran through 2026-06-09.
Key teaching point: An M-of-N multisig only provides M-of-N security when the N signer keys are independently held. Humanity Protocol's ProxyAdmin Safes were nominally 3-of-6 (Ethereum) and 3-of-5 (BSC) — a defensible threshold on paper — but a **quorum of signer keys for both Safes was reachable from a single developer machine, so the effective threshold collapsed to one compromised endpoint. This is the multisig analogue of the T11.011 exchange-hot-wallet co-location anti-pattern: the protective assumption (signer-key independence) was violated off-chain, and no amount of on-chain threshold configuration could compensate. The defender lesson is twofold — (a) signer-key independence is a first-class operational invariant**: multisig signers must hold keys on segmented, EDR/MDM-monitored, ideally hardware-isolated endpoints, and a single host must never hold a quorum of any Safe's keys, let alone quorums of multiple Safes across multiple chains; and (b) supply-affecting authority (mint, upgrade) needs a circuit-breaker independent of the multisig (timelock with a public review window, mint caps), because the multisig threshold is exactly the control that co-location defeats. Humanity is OAK's canonical 2026 anchor for multisig signer-quorum co-location and the first worked example where the T11.011 co-location pattern is observed at the protocol-governance-multisig layer rather than the exchange-hot-wallet layer.

Summary

Humanity Protocol is an identity / proof-of-humanity protocol whose native $H token is deployed on Ethereum and BNB Smart Chain, with a token bridge between the two. Critical infrastructure — the bridge's ProxyAdmin on Ethereum and the token contract's ProxyAdmin on BSC — was held behind Gnosis Safe multisigs (3-of-6 on Ethereum, 3-of-5 on BSC), and an additional admin hot wallet held a working balance of $H.

Between 2026-06-08 and 2026-06-09, an attacker who had compromised a single developer's machine obtained seven private keys that were present on (or backed up to) that host. The keys spanned the admin hot wallet and a voting quorum of each of the two ProxyAdmin Safes. With those keys the attacker executed three composed actions:

Direct theft (~6M $H). The admin hot-wallet key was used to transfer ~6,000,000 $H directly to attacker-controlled addresses.
Ethereum bridge takeover (~141M $H). Controlling 3 of 6 Ethereum Safe owners, the attacker transferred Safe ownership, upgraded the bridge contract via ProxyAdmin to a malicious implementation, and drained ~141,000,000 $H in a single transaction.
BSC unbounded mint (~300M $H). Controlling 3 of 5 BSC Safe owners, the attacker seized the ProxyAdmin, upgraded the token contract, and minted ~300,000,000 new $H to itself.

In aggregate ~447,000,000 $H were stolen or freshly minted. The attacker sold stolen and minted $H for ETH across DEX liquidity, crashing the token ~80–90% within hours and realising an estimated ~$32–36M. Humanity Protocol confirmed the root cause as a compromised developer machine holding multiple private keys, explicitly noting that no smart-contract bug was exploited — every action used legitimately authorised keys.

Why this is structurally significant

Humanity Protocol is the case where OAK's two custody-architecture techniques meet a multisig threshold and the threshold loses:

T15.003 (developer-endpoint compromise) is the proximate cause and the only off-chain failure. The keys did not leak from the contracts, the bridge, or a signing vendor — they leaked from one workstation that held seven of them. This is the same developer-workstation-as-key-store failure as Radiant Capital (October 2024) and Concentric Finance (January 2024), but at larger blast radius because of what those seven keys were.
T11.011 (multi-chain key-store co-location) is the architectural amplifier that turned one endpoint into a two-chain catastrophe. T11.011's canonical anchors (Poloniex, HTX, Indodax, Phemex) are exchange hot-wallet co-locations; Humanity extends the technique to protocol-governance multisig signer keys co-located across Ethereum and BSC. The diagnostic T11.011 signature — simultaneous, near-instantaneous extraction across multiple chains from a single compromise — is present exactly as the technique predicts.
The multisig threshold is the control co-location defeats. A 3-of-6 Safe assumes its six signer keys are six independent compromise events. When three of them sit on one machine, the Safe is a 1-of-1. Humanity shows the failure compounds: the same machine also held a quorum of the other chain's 3-of-5 Safe, so the attacker did not even need to pivot between two independent intrusions.
T6.005 (proxy-upgrade malicious switching) is the on-chain extraction primitive on both chains, in its operator-key-compromise sub-class — the upgrade authority was reached via the compromised quorum, the contracts were legitimate audited deployments up to the upgrade, and the upgradeTo-to-malicious-implementation event is the on-chain fingerprint (the Wasabi Protocol / Uplift DAO shape, here duplicated across two chains).
T9.004 (open mint) sets the BSC blast radius: once the token contract was upgraded, mint authority was unbounded. The 300M-token mint is bounded only by the contract's data type; the realised loss is bounded by liquidity depth (T5.001).

Timeline (UTC)

When	Event	OAK ref
Pre-2026-06-08	$H deployed on Ethereum + BSC behind Gnosis Safe ProxyAdmins (`3-of-6` ETH, `3-of-5` BSC); admin hot wallet holds working $H. A single developer machine holds/has-backed-up seven of the relevant private keys	(standing T11.011 + T15.003 surface)
~2026-06-08	Malware on the developer machine yields seven private keys to the attacker	T15.003 entry
2026-06-08	Admin hot-wallet key transfers ~6M $H directly to attacker	T11.011 / direct theft
2026-06-08	Ethereum: attacker (3-of-6 quorum) transfers Safe ownership, upgrades the bridge contract via ProxyAdmin, drains ~141M $H in one tx	T6.005 + T11.011 execution
2026-06-08 → 06-09	BSC: attacker (3-of-5 quorum) seizes ProxyAdmin, upgrades the token contract, mints ~300M $H	T6.005 + T9.004 execution
2026-06-08 → 06-09	Stolen + minted $H sold for ETH across DEX liquidity; $H falls ~80–90%	T5.001 extraction
2026-06-09	Humanity Protocol publishes post-mortem: ~447M $H affected, root cause = compromised developer machine / seven keys, "not a smart-contract exploit"	(operator disclosure)
2026-06-09	Quantstamp publicly links the breach to North-Korea-tied actors (no disclosed evidence; independent researchers skeptical)	(contested attribution)

What defenders observed

Pre-event (signer-key independence not enforced). Seven privileged keys — including quorums of two Safes on two chains — were present on a single developer machine. There is no on-chain signal for this; the exposure lives entirely at the endpoint-architecture layer. Defender lesson: treat "how many privileged keys can a single endpoint reach" as a measured operational metric, and require that no host holds a quorum of any multisig (OAK-M19 signing-host segmentation; EDR/MDM on every signer endpoint).
At-event (on-chain upgrade + mint signals). The load-bearing on-chain events are Safe ownership transfer, ProxyAdmin upgradeTo on the bridge (Ethereum) and token (BSC) contracts, and a large mint with no corresponding collateral/deposit (BSC). A real-time monitor on proxy-implementation-change and admin-rotation events without a governance correlation (the T6.005 detection signal) would have fired on the upgrade; a supply-monitor (mint magnitude vs historical supply) would have fired on the 300M mint. Both are confirmation-grade once observed, but by then extraction is underway.
At-event (simultaneous cross-chain extraction). Large $H outflows on both Ethereum and BSC within the same short window are the T11.011 co-location diagnostic — a pattern incompatible with two independent per-chain intrusions and a high-confidence indicator that key material was co-located.
Post-event (market signal + disclosure). The ~80–90% drawdown is the market pricing the dilution; it is a confirmation, not an early signal. Humanity's disclosure language — "compromised admin keys," "not a smart-contract exploit," affecting both chains — itself encodes the co-location architecture, exactly as T11.011's "single operator-side disclosure covering all affected chains" indicator predicts.

What this example tells contributors writing future Technique pages

Multisig-signer-quorum co-location is a distinct T11.011 sub-shape worth naming. The existing T11.011 anchors are exchange hot wallets; Humanity is the protocol-governance-multisig instance. Future contributors should record, per incident, whether the compromised keys included a quorum of any multisig and whether those keys were co-located, because that is the variable that converts a "stolen key" into a "defeated threshold." This is a forward candidate for a T11.011 sub-Technique (see TAXONOMY-GAPS).
Map the full off-chain-to-on-chain chain. The chain is T15.003 (endpoint) → T11.011 (co-location architecture) → T6.005 (upgrade primitive) → T9.004 (open mint) → T5.001 (dump). The endpoint compromise is proximate; the co-location is the amplifier; the upgrades and mint are the on-chain primitives; the dump sets realised loss. Do not collapse this to "private key hacked."
Be conservative on state attribution absent disclosed evidence. A single firm's "ties to North Korea" with no published cluster/implant/TTP basis, contested by independent researchers, is not an OAK-G01 mapping. Record it as a noted-but-unsubstantiated assessment and keep the attribution pseudonymous until corroborated.
Record the notional-vs-realised gap. 447M $H nominal vs ~$32–36M realised is the liquidity-depth bound; log both figures as OAK does for Holograph, MAP, and TesseraDAO.

Public references

[cryptobriefinghumanity2026] — CryptoBriefing, "Humanity Protocol blames $H token exploit on developer machine compromise" (root cause = single infected developer machine, seven keys, coordinated cross-chain): https://cryptobriefing.com/humanity-protocol-blames-h-token-exploit-on-developer-machine-compromise/
[cryptotimeshumanity2026] — Crypto Times, 2026-06-09, "Three Breach Vectors, 447M Tokens: Humanity Protocol Details $H Exploit" (the three vectors, 3-of-6 ETH + 3-of-5 BSC quorums, ProxyAdmin upgrades, ~6M/~141M/~300M token figures): https://www.cryptotimes.io/2026/06/09/three-breach-vectors-447m-tokens-humanity-protocol-details-h-exploit/
[coindeskhumanity2026] — CoinDesk, 2026-06-09, "Humanity Protocol token crashes more than 80% after a $32 million private-key hack": https://www.coindesk.com/tech/2026/06/09/humanity-protocol-token-crashes-more-than-80-after-a-usd32-million-private-key-hack
[cryptonewshumanity2026] — crypto.news, "Humanity Protocol says compromised admin keys led to $36M exploit": https://crypto.news/humanity-protocol-says-compromised-admin-keys-led-to-36m-exploit/
[blockonomihumanity2026] — Blockonomi, "Humanity Protocol Hack: How One Infected Device Handed an Attacker Seven Private Keys": https://blockonomi.com/humanity-protocol-hack-how-one-infected-device-handed-an-attacker-seven-private-keys/
[quantstamphumanity2026] — CryptoBriefing, "Quantstamp links June 8 $H token breach to North Korean hackers" (single-firm DPRK assessment, no disclosed evidence; independent-researcher skepticism noted): https://cryptobriefing.com/quantstamp-h-token-breach-north-korean-hackers/

Discussion

Humanity Protocol belongs to OAK's 2026 "stolen keys, not flawed code" cohort — the dominant 2026 pattern in which the largest losses come from compromised credentials against contracts that did exactly what they were programmed to do. Its specific contribution is to show that multisig is not a substitute for signer-key independence. The protocol had multisigs precisely where best practice says to put them — on the bridge and token ProxyAdmins — and the multisigs were defeated not by an on-chain flaw but by the off-chain co-location of a quorum of signer keys on one developer machine. The 3-of-6 and 3-of-5 thresholds were security theatre once a single host could produce three valid signatures for each.

The cross-chain dimension is what makes it a clean T11.011 anchor rather than just a multisig-hygiene anecdote. The same compromised machine held a quorum for both the Ethereum and BSC Safes, so the attacker enjoyed simultaneous two-chain authority from a single intrusion — the exact "co-located key material → simultaneous multi-chain extraction" signature T11.011 was written to name. Where Poloniex/HTX/Indodax/Phemex show the pattern at exchange hot wallets, Humanity shows it at protocol governance multisigs, and the lesson generalises: any operator whose multi-chain control keys can be reached from one endpoint has a 1-of-1 no matter what the on-chain threshold says.

On attribution, the case is also a methodological marker. The temptation to file every 2026 key-compromise theft under OAK-G01 is strong because the year's pattern fits the DPRK template — but a single firm's unsupported "ties to North Korea," contested by other researchers, does not clear OAK's inferred-strong bar. The honest record is pseudonymous with the Quantstamp claim noted and flagged as unsubstantiated; promotion waits on corroborating on-chain cluster or implant-family evidence. Contributors extending the 2026 key-compromise cohort should hold this line: the mechanism (developer-machine compromise, co-located multisig quorum) is well-established and is the durable teaching content; the actor is not.