would

Humanity

A malicious attachment delivered through a phishing email points to the involvement of North Korea-linked threat actors in Humanity Protocol's recent hack, according to blockchain security company Quantstamp.
The decentralized identity company said <a href="https://cointelegraph.com/news/humanity-protocol-laptop-bridge-exploit-h-token" rel="noopener noreferrer nofollow">a compromised employee's laptop</a> enabled attackers to steal $36 million in Humanity (H) tokens on Monday.
The malicious attachment was disguised as a token lockup schedule update from South Korean cryptocurrency exchange Bithumb. It installed malware that gave attackers full remote access to the laptop, Quantstamp said in its incident response.
<img alt="Humanity Protocol’s $36M loss tied to suspected North Korean hackers: Quantstamp" height="785" src="https://s3-images.ctmedia.io/media/content/pasted-image-1467.png" width="1256">
The phishing email that led to the Humanity Protocol compromise. Source: Quantstamp
Quantstamp added that the malware was signed with a South Korean Hancom digital certificate, a pattern it described as “characteristic of DPRK intrusions.” The malware enabled attackers to copy Humanity Protocol director Chong Yee Wai's MetaMask wallet credentials and private keys.
The suspected North Korean link would add to a series of major crypto thefts attributed to the country. North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in <a href="https://cointelegraph.com/features/north-korean-hackers-578m-april-kelp-dao-exploit" rel="noopener noreferrer nofollow">crypto-related incidents in April</a>.
<h2 id="north-korean-hackers-tied-to-some-of-the-largest-crypto-hacks">North Korean hackers tied to some of the largest crypto hacks</h2>
According to a May report by blockchain security company CertiK, the same actors have been linked to about $2 billion of the $3.4 billion <a href="https://cointelegraph.com/news/north-korea-industrialized-crypto-theft-laundered-billions-report-finds" rel="noopener noreferrer nofollow">lost to crypto exploits in 2025</a>, while accounting for 12% of total incidents. CertiK said the figures reflect a focus on “precision and scale.”
Over the past decade, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents, the <a href="https://indd.adobe.com/view/595e40e3-3953-4d4b-aeaa-3e9954d5d844" rel="noopener noreferrer nofollow">report</a> said.
Related: <a href="https://cointelegraph.com/news/cz-crypto-seal-60-north-korean-hackers" rel="noopener noreferrer nofollow">CZ sounds alarm as ‘SEAL’ team uncovers 60 fake IT workers linked to North Korea</a>&nbsp;
CertiK added that North Korea has “industrialized” crypto theft into a core state revenue mechanism, making these operations a substantial share of the regime’s external income.
<img alt="Humanity Protocol’s $36M loss tied to suspected North Korean hackers: Quantstamp" height="482" src="https://s3-images.ctmedia.io/media/content/pasted-image-1468.png" width="715">
Total DPRK crypto theft over the years. Source: CertiK/Skynet
North Korea rarely responds to cybercrime allegations, but on May 3, a Foreign Ministry spokesperson <a href="https://cointelegraph-magazine.com/north-korea-denies-crypto-hacks-upbits-bank-tests-ripple-asia-express/" rel="noopener noreferrer nofollow">rejected them in a statement</a> carried by the Korean Central News Agency, the country's state media.
The spokesperson accused the US of spreading “incorrect” narratives about the “non-existent ‘cyber threat’” from North Korea.
Magazine: <a href="https://cointelegraph-magazine.com/coinbase-hack-law-protect-heres-why/" rel="noopener noreferrer nofollow">Coinbase hack shows the law probably won’t protect you — Here’s why</a>

Humanity Protocol’s $36M loss tied to suspected North Korean hackers: Quantstamp

Table of Contents

Cointelegraph

Other articles published on Jun 14, 2026

Join our free newsletter for daily crypto updates!