Major hacks are nothing new in the crypto world, but when such incidents occur in a major project, it creates a discussion in the entire ecosystem. Recently, Humanity Protocol faced a major security issue worth about $36 million.
According to the forensic report, the root cause of this incident was a developer machine that was infected with malware. That single machine was the one that stored seven important private keys of the project. These included the admin hot wallet key, some keys for the Ethereum multi-sig setup, and the multi-sig keys for the BNB Smart Chain. This created an opportunity to take control of the entire system from one place.
The hacker first entered the infected machine and after gaining root access, collected all the private keys. Then the attack was carried out in stages. First, some tokens were removed from the Ethereum network hot wallet. Then, the multi-sig keys were used to seize control of the bridge and change it to a malicious version. As a result, it was possible to drain a large amount of tokens at once.
Then, the BNB Smart Chain was attacked and new tokens were created multiple times using the token contract, which greatly increased the total supply and created major pressure on the market. In a very short time, the project lost all control.
The investigation said that there was no smart contract bug or blockchain vulnerability behind this whole incident. The main problem was the weakness of private key management. All important keys were backed up on a single device, which put the entire system at risk if the malware was infected.
After the incident, the project stopped bridge operations and started an investigation. In addition, a 1 million USDT bounty was announced to recover the stolen funds.
After this incident, the token price in the market also dropped significantly and investor confidence was hit hard. This once again shows that the biggest risk in crypto security is not just the code, but how private keys are stored and managed is equally important.
