Decentralized identity project Humanity Protocol suffered a $36 million security breach, resulting in a 73% collapse of its native H token. The exploit happened when hackers compromised a private key stored on an employee’s laptop, granting them admin-level access to the protocol’s infrastructure.
This incident highlights a growing crisis in 2026 for the decentralized finance sector, where sophisticated operational security failures are bypassing highly audited smart contracts entirely. In response to the ongoing drain, the Humanity Protocol team officially halted all bridge activity to contain the bleeding.
Once inside the system, the attackers did not just steal existing funds. They executed malicious contract upgrades to seize control of the bridge functionality. The hackers drained approximately 141.2 million native H tokens and then minted between 100 million and 200 million brand new tokens out of thin air.
The sudden influx of unauthorized tokens flooded the market, diluting the supply and triggering an aggressive sell-off. The price of the H token crashed by 73%, hitting an 88% drop during peak volatility before stabilizing slightly at its new low. Trading liquidity remains severely impacted.
Security researchers quickly traced the root cause back to human error rather than a coding flaw. Meir Dolev, co-founder and chief technology officer of blockchain security firm Cyvers, evaluated the exploit and confirmed the laptop breach, according to Decrypt. Dolev stated it was “an operational security failure, not a smart-contract bug.”
Why Operational Security is Bypassing Smart Contract Audits
The Humanity Protocol exploit exposes a specific structural weakness currently punishing the broader decentralized finance industry. Teams spend hundreds of thousands of dollars auditing their smart contract code to prevent mathematical exploits, but those audits do not protect the physical hardware used by employees.
When an attacker gains control of an admin key through a laptop compromise, they inherit the legitimate authority to rewrite the rules of the protocol. This allows them to bypass the audited code entirely and authorize malicious upgrades, effectively turning the protocol’s own security mechanisms against itself.