Drift

DeFi

April

Humanity

Humanity Protocol will refocus its cybersecurity efforts on operational security following a June $36 million exploit that was traced back to a compromised employee laptop, according to the founder of the decentralized identity company, Terence Kwok.
In an interview with Cointelegraph, Kwok said that the exploit stemmed from last year’s mainnet launch, when several production keys were inadvertently backed up onto the laptop that was compromised, including admin hot wallet keys and a quorum of multisig owner keys across both chains.&nbsp; He said:
<blockquote>
 “The hard lesson here is that operational security is as critical as smart-contract security, and we’re rebuilding accordingly.”
</blockquote>
The exploit and Humanity Protocol’s action highlight an increase in cryptocurrency hackers refocusing their attacks on staff-level vulnerabilities and operational shortcomings, rather than exploiting smart contract code.
Humanity Protocol was exploited last month, when a <a href="https://cointelegraph.com/news/humanity-protocol-laptop-bridge-exploit-h-token" rel="noopener noreferrer nofollow">compromised employee’s laptop</a> enabled attackers to steal $36 million in Humanity (H) tokens. The token’s current market cap is roughly $211 million, according to CoinMarketCap <a href="https://coinmarketcap.com/currencies/humanity-protocol/" rel="noopener noreferrer nofollow">data</a>.
Blockchain security company Quantstamp said that the malicious attachment that was delivered through a phishing email pointed to the involvement of <a href="https://cointelegraph.com/news/humanity-protocol-hack-linked-north-korean-actors-quantstamp" rel="noopener noreferrer nofollow">North Korea-linked</a> threat actors. The malicious attachment was disguised as a token lockup schedule update from South Korean cryptocurrency exchange Bithumb and installed malware, giving attackers remote access to the machine.
<img alt="" height="785" src="https://s3-images.ctmedia.io/media/content/pasted-image-2020.png" width="1256">
The phishing email that led to the Humanity Protocol compromise. Source: Quantstamp
North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in <a href="https://cointelegraph.com/features/north-korean-hackers-578m-april-kelp-dao-exploit" rel="noopener noreferrer nofollow">crypto-related incidents in April</a> alone.&nbsp;
Related: <a href="https://cointelegraph.com/news/dragonfly-defi-ai-hackpocalypse-fears" rel="noopener noreferrer nofollow">AI has not triggered DeFi ‘hackpocalypse,’ Dragonfly partner says</a>
<h2 id="phishing-and-wallet-compromises-lead-attack-vectors-in-h1-2026">Phishing and wallet compromises lead attack vectors in H1 2026</h2>
The Humanity Protocol exploit occurred during a resurgence of cryptocurrency exploits that stemmed from operational failures and social engineering schemes.
<a href="https://cointelegraph.com/news/crypto-hacks-fell-47-percent-in-h1-but-ecosystem-is-no-safer-certik" rel="noopener noreferrer nofollow">Phishing drove the majority</a> of the first quarter losses for a total of $508 million, while wallet compromises emerged as the biggest attack vector in the second quarter, contributing $807 million in losses, according to blockchain security company CertiK.
<img alt="" height="754" src="https://s3-images.ctmedia.io/media/content/pasted-image-2021.png" width="1302">Monthly change in crypto exploit amounts and number of incidents across H1. Source: CertiK&nbsp;
To be sure, crypto losses to hacks fell 46.8% year-on-year to $1.32 billion in the first half of 2026, but CertiK said that the drop was misleading due to the $1.4 billion Bybit hack in early 2025 and stressed that North Korean malicious actors continue threatening the crypto industry.
During the second quarter of 2026, more than 70% of the losses stemmed from the <a href="https://cointelegraph.com/news/drift-280-million-hack-questions-circle-response" rel="noopener noreferrer nofollow">Drift Protocol</a>&nbsp;and&nbsp;<a href="https://cointelegraph.com/news/restaking-platform-kelp-exploited-293-million" rel="noopener noreferrer nofollow">KelpDAO</a>&nbsp;exploits, which were also widely attributed to North Korean state-sponsored hackers.
Magazine: <a href="https://cointelegraph.com/features/does-botanixs-failure-prove-bitcoiners-dont-care-about-defi" rel="noopener noreferrer nofollow">Does Botanix’s failure prove Bitcoiners don’t care about DeFi?</a>&nbsp;

Humanity Protocol to prioritize operational security following $36M hack

Table of Contents

Cointelegraph

Other articles published on Jul 14, 2026

Join our free newsletter for daily crypto updates!