Humanity's $36 million exploit happened because a 'multisig' lived on one laptop

Humanity Protocol explained how attackers were able to steal more than $36 million of its H token, and the cause was a serious lapse in how it secured its keys.

In an incident update shared with CoinDesk, the decentralized identity project said the breach started when an employee's laptop was compromised. The machine held several keys that controlled the project's token bridges, the tools that move H (and other tokens) between blockchains.

Those bridges ran through multisignature wallets, which require a number of separate keys to approve any change. A multisignature wallet is supposed to spread keys across different people and devices so that no single machine can move funds.

In this case, all the keys were stored on a single device, meaning a compromise allowed the exploier to cross the approval threshold on both chains, Humanity said.

The attacker obtained three of the six keys controlling the bridge's admin account on Ethereum, enough to seize controls linked to the project's deployment on the network.

The attacker then transferred ownership to their own wallet, swapped the bridge's code for a malicious version and drained about 141 million H in one transaction.