When the Keys to Your Identity Protocol Become the Attack Vector: Anatomy of Humanity Protocol's $32M Collapse

Humanity Protocol — a biometric Proof-of-Humanity blockchain — lost $32 million and watched its H token crash 90% in hours after malware on a single developer machine exposed seven private keys controlling bridge upgrades, token minting, and multisig governance across two chains.

Executive Summary

• $32M drained, ~447M H tokens affected: Attackers used seven compromised private keys to drain 147M H from Ethereum bridges and mint 300M new H on BNB Smart Chain in a multi-stage operation on June 8–9, 2026.

• H token collapsed 90% intraday: The H token fell from an all-time high of ~$0.84 (June 1) to a low of $0.05, with ZachXBT publicly questioning whether the incident was "possibly staged" as a market-maker exit.

• The attack exploited operational security, not code: Humanity's smart contract architecture was never breached — a malware-infected developer laptop holding production keys in plaintext backup files was the single point of failure, exposing a systemic flaw in the emerging biometric identity sector's DevSecOps practices.

• Token unlock overhang compounds the damage: A 266.47M H cliff unlock is scheduled for June 25, 2026, releasing ~$45M worth of tokens at pre-hack prices, with some institutional holders already opting for a 70% haircut for immediate liquidity — a vote of no confidence in recovery.

• The incident reframes the biometric identity race: As Worldcoin faces mounting regulatory scrutiny, Humanity Protocol's collapse removes the most credible "privacy-first" challenger, creating a vacuum that incumbents like Polygon ID and civic infrastructure projects will move to fill.

Background & Market Context

Humanity Protocol launched its mainnet in August 2025 with a $1.1 billion valuation, positioning itself as the privacy-conscious answer to Worldcoin's iris-scan empire. Where Worldcoin requires users to stare into a centralized "Orb" device, Humanity Protocol offers palm-scan biometrics tied to zero-knowledge proofs — a distinction that earned it significant institutional credibility and backed it with Series A capital. Built as a zkEVM Layer 2 on Polygon's Chain Development Kit, the protocol combined Proof-of-Humanity (PoH) consensus with Self-Sovereign Identity (SSI) frameworks, allowing users to prove their uniqueness without revealing their actual biometric data on-chain.

The macro backdrop entering June 2026 was favorable on paper. The AI agent ecosystem had created explosive demand for Sybil-resistance solutions — any application deploying autonomous agents needs a reliable way to distinguish human participants from bots, and biometric identity protocols were positioned as foundational infrastructure. Worldcoin's market cap had shed roughly 78% from its peak, dragged down by regulatory bans across multiple European jurisdictions and persistent concerns about its centralized hardware model. This opened a significant opportunity for Humanity Protocol, which had been actively capturing Worldcoin's displaced user base; one April 2026 report noted H surging 65% as Worldcoin's credibility deteriorated.

The broader 2026 crypto security landscape provided the ominous context for what was to come. Security researchers had been warning throughout the year that the dominant theft vector had shifted from smart contract exploits to private key theft — operational security failures rather than code vulnerabilities. The Bybit hack in early 2025 had already demonstrated how devastating key compromise could be at scale. Humanity Protocol's exploit fits this 2026 pattern precisely: not a flaw in bridge logic, not a reentrancy vulnerability, not an oracle manipulation — simply the catastrophic exposure of production credentials on an insufficiently hardened developer endpoint.

At the time of the attack, H was trading near its all-time high of approximately $0.84, reached just eight days prior on June 1, 2026. The protocol had been live on mainnet for roughly ten months, had deployed physical "Humanity Scanner" hardware at crypto events and major cities, and was actively integrating zkTLS technology to bridge Web2 credentials with its decentralized identity layer. The timing of the attack — at peak valuation, just before a major token unlock — is one of several factors that fueled ZachXBT's suspicion that the "hack" may have served interests beyond those of an external attacker.

Key Developments

August 2025 — Mainnet Launch at $1.1B Valuation: Humanity Protocol officially launched its mainnet, marketing itself as a "Worldcoin rival" offering privacy-first, palm-scan-based decentralized identity. The launch introduced the protocol's zkEVM architecture, Proof-of-Humanity consensus mechanism, and a physical scanner network that would expand to crypto conferences and major metropolitan areas. The $1.1B valuation signaled serious institutional backing and positioned H as a top-tier identity layer asset.

June 1, 2026 — H Token Reaches All-Time High: H token hit an all-time high of approximately $0.8358, benefiting from Worldcoin's ongoing credibility problems and broader market momentum in the AI/identity sector. The protocol was actively promoting its mainnet Phase 3 rollout and scanner expansion. The timing is critical: this peak came just eight days before the exploit, and the proximity prompted subsequent questions about insider knowledge of the impending attack.

June 8, 2026 (First Wave) — Admin Hot Wallet Drained: The attack began with the compromise of a single admin hot wallet private key on Ethereum. Attackers drained 6.04 million H tokens from this wallet. This first wave was relatively modest but indicated that the attacker had already obtained full key material. The use of a legitimate private key meant no on-chain alerts were triggered — the transactions appeared identical to authorized team operations.

June 8–9, 2026 (Second Wave) — Bridge ProxyAdmin Exploitation: Using three compromised Ethereum Safe owner keys, the attacker transferred ProxyAdmin ownership of Humanity Protocol's Ethereum bridge. They then upgraded the bridge to a malicious implementation contract and executed a single transaction draining 141.18 million H — the largest single movement of the attack. The Gnosis Safe on Ethereum had a 4-of-7 threshold; the attacker had only 3 keys, meaning they could not achieve consensus for the Safe transaction directly. The investigation suggests the ProxyAdmin control was held by fewer signatories, enabling the bridge drain without requiring full multisig quorum.

June 9, 2026 (Third Wave) — BSC Token Minting: With three compromised BNB Smart Chain Safe owner keys controlling the BSC token's ProxyAdmin, the attacker executed three separate mint transactions of 100 million H each, inflating supply by 300 million tokens. This minting capability — the ability to create new supply at will — is the most damning technical detail. In a legitimately secured protocol, the ability to mint tokens should require either a hardware security module or an air-gapped multisig well above any single device's key set. The fact that production minting authority resided on a developer machine backup reflects a catastrophic gap in key management policy.

June 9, 2026 — Token Crash and ZachXBT Allegations: H collapsed from approximately $0.67 (the opening price on June 9 before news broke) to a low near $0.05 — an intraday crash of over 90%. The attacker converted stolen H to ETH primarily through decentralized exchanges. Prominent on-chain analyst ZachXBT posted that the incident "seems possibly staged," writing he was "not buying the team's story; it's a convenient way for the active MM to have exited." He noted the dumps were concentrated on DEXes rather than through patterns typical of external hackers. Though he later softened his stance, the statement dominated social media and accelerated the selloff.

Post-Hack — Team Response and Bounty: Founder Terence Kwok confirmed the private key compromise, urged users to avoid the bridge and liquidity pools, and announced a $1 million USDT recovery bounty. The team launched a public recovery tracker and engaged security firms and exchange partners to freeze funds. A subsequent investigation confirmed all seven keys were extracted from a single malware-infected developer device where they had been "inadvertently backed up" during the mainnet launch in June 2025 — meaning the keys sat exposed on that device for nearly a full year.

Technical Analysis

The Humanity Protocol exploit is a textbook case of what the security community calls an "operational security failure in a cryptographically secure system" — the cryptographic primitives were unbroken, but the human and procedural layer around key custody was catastrophically weak. The attack exploited seven private keys extracted from a single device rather than any vulnerability in the protocol's Solidity contracts, ZK proof system, or Gnosis Safe architecture. This distinction matters enormously: Humanity's bridge contracts, token contracts, and Safe configurations performed exactly as designed. The failure was entirely upstream, in how the team stored and protected the secrets that authorized those contracts.

The key hierarchy reveals the scope of the design flaw. The attacker obtained: one admin hot wallet key (direct Ethereum spend authority), three Ethereum Safe owner keys (sufficient to control bridge ProxyAdmin under the Safe's 3-of-6 or similar configuration), and three BNB Smart Chain Safe owner keys (controlling the BSC token's ProxyAdmin and mint authority). The Gnosis Safe multisig is a widely trusted custody primitive, but its security model assumes that individual owner keys are stored on separate, independently secured devices — ideally hardware wallets with distinct physical custody. Storing three Safe owner keys on a single developer machine reduces a 3-of-6 multisig to effectively a 1-of-1 trust model, since compromising that one device yields the required threshold.

The bridge ProxyAdmin exploitation is particularly instructive. Ethereum proxy upgrade patterns (EIP-1967 transparent proxies) separate the "logic" contract from the "storage" contract, allowing the proxy admin to swap in new logic at any time. This is a powerful administrative capability designed for authorized upgrades — and a catastrophic attack vector if the admin key is compromised. The attacker used their three Safe owner keys to transfer ProxyAdmin ownership, then deployed a malicious logic contract that drained all bridged H in a single call. The use of 141.18M H in one transaction suggests the attacker understood the architecture well enough to maximize extraction efficiency — consistent with either sophisticated external reconnaissance or insider knowledge.

The BSC minting capability represents the most systemically dangerous element. Minting authority — the ability to expand total token supply — is the most sensitive permission in any token system. Standard best practices require this capability to reside in hardware security modules (HSMs), threshold signature schemes across geographically distributed signers, or time-locked governance. That BSC mint authority was accessible through Safe owner keys stored on a developer device backup suggests the team treated minting as an operational convenience rather than a critical security boundary. The three mint transactions of 100M H each appear calibrated to maximize extracted value while staying below thresholds that might trigger automatic exchange circuit breakers — another signal of either sophisticated external attack or insider coordination.

sequenceDiagram
    participant M as Malware / Attacker
    participant D as Developer Machine (Compromised)
    participant EA as Ethereum Admin Wallet
    participant ES as Ethereum Gnosis Safe (3-of-6)
    participant EB as Ethereum Bridge Contract (Proxy)
    participant BS as BSC Gnosis Safe (3-of-5)
    participant BT as BSC H Token Contract (Proxy)
    participant DEX as DEX Liquidity Pools

    M->>D: Infect with malware (~June 2025 backup)
    M->>D: Extract 7 private keys (1 hot wallet + 3 ETH Safe + 3 BSC Safe)
    M->>EA: Sign & broadcast: drain 6.04M H tokens (Wave 1)
    EA-->>DEX: 6.04M H → ETH (sold)
    M->>ES: Submit Safe tx with 3 compromised keys (3-of-6 threshold met)
    ES->>EB: Transfer ProxyAdmin ownership to attacker
    M->>EB: Upgrade proxy to malicious implementation
    EB-->>DEX: 141.18M H drained in single tx (Wave 2)
    M->>BS: Submit Safe tx with 3 compromised BSC keys
    BS->>BT: Transfer ProxyAdmin to attacker
    M->>BT: Mint 100M H (tx 1)
    M->>BT: Mint 100M H (tx 2)
    M->>BT: Mint 100M H (tx 3)
    BT-->>DEX: 300M H minted & dumped (Wave 3)
    Note over DEX: H crashes 90%, $32M+ extracted as ETH

On-Chain & Market Data

The on-chain data reveals two distinct damage vectors: the immediate extraction of ~$32M in existing tokens converted to ETH, and the creation of 300M in new supply on BSC — an inflationary weapon that extends selling pressure far beyond the initial hack. At pre-crash prices, those 300M minted tokens represented roughly $200M in potential additional downside; even at post-crash prices they represent a substantial overhang. The H token's rapid stabilization around $0.13–$0.17 (rather than approaching zero) suggests some buyers interpreted the crash as an oversold dislocation from a protocol whose underlying infrastructure remains intact, but the conviction of that bid is fragile.

The June 25 unlock adds a structurally bearish dynamic that may prove as damaging as the hack itself. The Humanity Foundation's decision to offer investors a 70% haircut for immediate liquidity is an extraordinary concession — and the institutions that accepted it had already written off 70 cents of every dollar invested, suggesting deep skepticism about near-term recovery. The unlock represents 2.7% of total supply hitting the market at a time when the protocol's credibility is at its nadir, CEX deposits may be partially frozen by exchange partners, and retail sentiment has been demolished. Even if the stolen funds are never recovered, the protocol faces a structural supply shock that complicates any price recovery thesis.

Competitive Landscape

Worldcoin (WLD): Humanity Protocol's most prominent rival uses iris-scan technology delivered through centralized "Orb" hardware devices. Worldcoin has shed approximately 78% of its peak market cap (from ~$39.1B to ~$832M) under pressure from regulatory bans in multiple European and Asian jurisdictions, biometric data privacy concerns, and controversy around its centralized data custody model. The Humanity Protocol collapse is paradoxically positive for Worldcoin in the near term — the narrative that "privacy-first" biometric identity is more secure has been punctured, and Worldcoin's established hardware network and exchange listings give it structural durability that Humanity's early-stage infrastructure lacked. However, Worldcoin's own security risks (centralized Orb data, Sam Altman association, regulatory exposure) make it a deeply flawed beneficiary.

Polygon ID / ERC-725x Identity Standards: Polygon's identity primitive layer takes a non-biometric approach, using ZK-based verifiable credentials that can be anchored to off-chain KYC without storing personal data on-chain. This approach sacrifices Sybil-resistance (you can create multiple identities if you can pass KYC multiple times) for a dramatically simpler operational security profile — no biometric scanners to deploy, no keys controlling minting authority. The Humanity Protocol incident strengthens the case for this lighter-weight approach in enterprise and DeFi contexts where biometric uniqueness is less critical than data privacy and compliance.

BrightID: A social graph-based identity system that establishes uniqueness through vouching relationships rather than biometrics. BrightID's security model is radically different — there are no master keys controlling token minting because there is no native token with inflationary risk. The trade-off is scalability and Sybil-resistance at scale: sophisticated actors can construct social graph attacks with enough patience. BrightID's operational security risk profile is fundamentally lower than Humanity Protocol's, but its utility for applications requiring provably unique identity at consumer scale is limited.

Civic (CVC) and Veriff-integrated solutions: Traditional KYC providers like Civic offer blockchain-anchored identity attestations but operate largely as permissioned systems with centralized verification. Their security model resembles traditional enterprise software — server-side key management, audit trails, compliance frameworks — rather than the decentralized ideals of the Web3 identity space. The Humanity Protocol incident may accelerate enterprise adoption of these more conservative models, as procurement teams weigh decentralization ideals against the demonstrated operational security risks of nascent Web3 identity infrastructure.

Stakeholder Analysis

Investors and Token Holders: The most immediate victims are retail and institutional H holders who experienced 80–90% drawdowns in hours. Institutional investors who funded the project face a compounded loss: their locked positions lost value in the crash, and the subset who accepted the 70% haircut for early unlock have crystallized losses far below their entry prices. Venture firms with equity stakes face a longer-horizon impairment as the protocol works to restore credibility. The incident represents exactly the "smart contract and custody risk" that institutional crypto allocators identify in due diligence — and it will likely tighten due diligence standards across the identity protocol sector.

Protocol Users (Biometric Identity Holders): Users who have registered their palmscan biometrics with Humanity Protocol face a distinct category of concern separate from token price: the long-term custody and security of their biometric enrollment data. The official investigation attributes the breach to private keys stored on a developer machine — not a compromise of the biometric database — but the event raises legitimate questions about the protocol's overall security culture. Unlike a lost password, a compromised palmprint cannot be changed. Users should monitor official communications carefully and understand that the biometric data security claims of any identity protocol are only as strong as the team's operational security practices.

Protocol Developers and Ecosystem Builders: Projects that integrated Humanity Protocol's Proof-of-Humanity layer for Sybil-resistance — DeFi applications, DAO governance systems, AI agent platforms — face immediate disruption. The bridge halt, frozen liquidity pools, and token credibility collapse mean that any application using H as a trust signal must either pause that functionality or switch providers. The ecosystem dependency creates a second-order contagion risk: the more deeply integrated Humanity Protocol was in an application's architecture, the more expensive the migration.

Regulators and Policymakers: The incident arrives at an inflection point for biometric identity regulation. Regulators in the EU (under GDPR and the proposed EU AI Act biometric provisions), the US, and Asia have been developing frameworks for biometric data in blockchain contexts. The Humanity Protocol collapse provides a concrete case study in the risks of storing biometric enrollment keys in insufficiently secured operational environments. Expect regulators to cite this incident in arguments for mandatory HSM requirements, independent security audits as a condition of biometric data collection, and operational security standards for protocols handling unique human identifiers.

Risk Assessment

1. Ongoing Supply Inflation from Minted BSC Tokens — The attacker minted 300M H on BSC and retains ProxyAdmin control of the BSC token contract. Without a successful contract upgrade to revoke that access (which requires recovering or rotating the BSC Safe keys), additional minting remains possible. Severity: Critical. Probability: Moderate — the attacker has little incentive to mint further if doing so depresses the value of tokens they already hold, but the capability exists and represents a permanent ceiling on any recovery narrative.

2. June 25 Token Unlock Supply Shock — The 266.47M H cliff unlock represents approximately 14.8% of circulating supply entering the market during a period of maximum protocol distress. Institutional holders who accepted the 70% haircut option will be motivated to sell immediately at any price above their discounted unlock cost basis (~30% of original value, approximately $0.25 at pre-hack prices). This creates structured selling pressure that could drive H toward or below the post-hack stabilization floor. Severity: High. Probability: High — the unlock is contractually scheduled and early-opt-in holders have pre-committed.

3. ZachXBT "Staged Hack" Narrative and Regulatory Scrutiny — ZachXBT's public allegation that the incident may have been staged as a market-maker exit creates legal and reputational risks that could outlast the hack itself. If regulators interpret the incident as potential market manipulation — using a claimed "hack" to liquidate a large insider position — Humanity Protocol faces securities fraud exposure in multiple jurisdictions. Even if the team is fully exonerated, the allegation has damaged the trust relationships with exchange partners, venture backers, and enterprise integration prospects that a biometric identity protocol depends on. Severity: High. Probability: Low-to-Moderate — the investigation is ongoing, and ZachXBT softened his initial statement, but the allegation is in the permanent public record.

4. Biometric Identity Sector Contagion and Regulatory Backlash — The incident may trigger a sector-wide confidence crisis in biometric identity protocols at precisely the moment when regulatory frameworks for such systems are being finalized. If policymakers use the Humanity Protocol breach as the basis for overly prescriptive operational security requirements — mandatory HSMs, independent key custody audits, bonding requirements — the compliance costs could structurally disadvantage smaller protocols and entrench centralized incumbents. The irony would be profound: a privacy-first decentralized identity protocol's security failure accelerating the consolidation of biometric identity infrastructure into the hands of large, regulated, centralized entities. Severity: Moderate. Probability: Moderate.

Investment & Strategic Implications

For crypto-native funds and digital asset allocators, the Humanity Protocol incident is a clear signal that private key management practices are now a primary diligence criterion — not a checkbox item. The pattern of major 2026 losses (Bybit, Radiant Capital, and now Humanity Protocol) consistently traces to operational security failures rather than code vulnerabilities. Any protocol with (a) upgrade authority, (b) token minting authority, or (c) bridge drain authority should be evaluated for whether those capabilities are adequately isolated across independently secured signing infrastructure. The presence of Gnosis Safe multisigs is insufficient assurance if the keys required to meet quorum thresholds coexist on shared machines. Diligence teams should explicitly request key custody architecture documentation and evidence of hardware security module usage for critical operations.

For protocols in the biometric identity and decentralized identity sectors, the strategic implication is a window of opportunity that comes with an elevated obligation. Worldcoin, Polygon ID, BrightID, and enterprise identity solutions will receive inbound interest from applications and enterprises previously building on Humanity Protocol. Capturing that interest requires demonstrating credibly superior operational security — not just marketing claims, but verifiable HSM architectures, independently audited key management policies, and Shamir Secret Sharing or threshold signature schemes for mint and upgrade authority. The protocols that can turn the Humanity Protocol incident into a concrete competitive differentiator by publishing their own key security architecture will be the structural winners.

For builders in the AI agent and DeFi space who relied on Humanity Protocol's Proof-of-Humanity layer, the immediate tactical priority is contingency planning: identify which features depend on H token verification, evaluate migration paths to alternative Sybil-resistance providers, and assess the legal and user-experience implications of a mid-deployment provider switch. The medium-term strategic implication is that single-provider dependency on any identity layer protocol — especially one this early in its maturity — represents unacceptable infrastructure risk. A multi-provider approach (e.g., accepting PoH attestations from both Humanity Protocol and Polygon ID with fallback logic) is the appropriate architectural response.

Outlook: 30 / 180 / 365 Days

• 30 days: H token remains rangebound between $0.07 and $0.20 as the June 25 unlock absorbs significant structural selling pressure. The Humanity Foundation's recovery tracker will show limited repatriation of stolen funds (the attacker has little incentive to return assets under the current $1M bounty structure). At least one exchange partner will formally suspend H deposits citing "security review," adding further liquidity headwinds. ZachXBT will either publish a definitive finding or retract the "staged" allegation based on on-chain evidence from the BSC mint transactions; the outcome of that investigation drives the 30-day narrative more than any team statement.

• 180 days: The protocol faces a binary bifurcation. In the recovery scenario (probability ~30%), the team successfully rotates all compromised keys, revokes the attacker's BSC ProxyAdmin access via an emergency governance vote, publishes a comprehensive post-mortem demonstrating upgraded key custody architecture, and re-lists on major exchanges — H recovers to the $0.25–$0.40 range as a heavily discounted but technically viable identity layer. In the collapse scenario (probability ~70%), the June 25 unlock supply shock, exchange delistings, and ZachXBT narrative contamination prevent sustained recovery; institutional backers write down positions and enterprise integrations migrate, leaving H in the $0.05–$0.12 range with declining developer activity.

• 365 days: Regardless of Humanity Protocol's individual fate, the incident permanently reframes operational security standards for the biometric identity sector. Regulatory frameworks in the EU and potentially the US will cite the hack in mandating hardware security module requirements for protocols collecting biometric enrollment data. The sector will consolidate around 2–3 players with demonstrably superior key management practices: one centralized (likely Worldcoin or a major tech-backed alternative), one enterprise-grade permissioned system, and potentially one decentralized protocol that emerges from the post-Humanity landscape with a credibly HSM-anchored architecture. The demand for biometric Proof-of-Humanity in AI agent applications will be larger in 12 months than today — the question is whether any decentralized protocol will be trusted enough to capture it.

References

1. CoinDesk — "Humanity Protocol token crashes more than 80% after a $32 million private-key hack" (June 9, 2026): https://www.coindesk.com/tech/2026/06/09/humanity-protocol-token-crashes-more-than-80-after-a-usd32-million-private-key-hack

2. The Block — "Wallets linked to Humanity Protocol drained for over $32 million, token plunges 89%" (June 9, 2026): https://www.theblock.co/post/404053/humanity-protocol-exploit

3. CryptoBriefing — "Humanity Protocol blames H token exploit on developer machine compromise": https://cryptobriefing.com/humanity-protocol-blames-h-token-exploit-on-developer-machine-compromise/

4. Crypto.news — "Humanity Protocol says attacker stole seven keys from one device": https://crypto.news/humanity-protocol-says-attacker-stole-seven-keys-from-one-device/

5. Bitcoin.com News — "Humanity Protocol Loses $32M in Private Key Hack as ZachXBT Calls Incident 'Possibly Staged'": https://news.bitcoin.com/humanity-protocol-exploit-zachxbt-staged/

6. CryptoTimes — "ZachXBT Calls $32M Humanity Protocol Hack 'Possibly Staged,' $H Crashes 86%": https://www.cryptotimes.io/2026/06/09/zachxbt-calls-32m-humanity-protocol-hack-possibly-staged-h-crashes-86/

7. NFT Plazas — "Humanity Protocol Founder Confirms Private Key Breach as H Token Collapses 90%": https://nftplazas.com/humanity-protocol-32m-exploit/

8. CoinGape — "H Token Crashes 90% as Humanity Protocol Suffers Over $30M Private Keys Hack": https://coingape.com/h-token-crashes-humanity-protocol-suffers-private-keys-hack/

9. BanklessTimes — "Humanity Protocol Surges 65% Amid Worldcoin's Credibility Problem" (April 29, 2026): https://www.banklesstimes.com/articles/2026/04/29/humanity-protocol-surges-65-amid-worldcoins-credibility-problem/

10. CoinDesk — "Worldcoin Rival Humanity Protocol Debuts $1.1B Mainnet for Privacy-First Web2 to Web3 Identity" (August 8, 2025): https://www.coindesk.com/business/2025/08/08/worldcoin-rival-humanity-protocol-debuts-usd1-1b-mainnet-for-privacy-first-web2-to-web3-identity

11. TokenomistAI — "Humanity (H) Tokenomics & Vesting Schedule": https://tokenomist.ai/humanity

12. CryptoRank — "Humanity Protocol (H) Token Unlocks and Vesting Schedule": https://cryptorank.io/price/humanity-protocol/vesting

13. WEEX Crypto News — "The Humanity Foundation announced adjustments to the H token vesting plan": https://www.weex.com/news/detail/the-humanity-foundation-announced-adjustments-to-the-h-token-vesting-plan-and-set-a-deadline-with-some-institutions-publicly-disclosing-their-choice-to-unlock-at-a-discount-immediately-710179

14. CCN — "Humanity Protocol Hit by $36M+ Private Key Hack, H Token Crashes 85%": https://www.ccn.com/education/crypto/humanity-protocol-private-key-hack-36m-h-token-crash/

15. Invezz / TradingView — "Can H token bounce back after Humanity Protocol's $32 million exploit?": https://www.tradingview.com/news/invezz:202917ba2094b:0-can-h-token-bounce-back-after-humanity-protocol-s-32-million-exploit/