Humanity Protocol, a decentralized identity project that uses palm scans to try to prove that users are human, has suffered a $36&nbsp;million loss after attackers compromised a laptop belonging to an employee. After the laptop was infected with malware, the malicious code gained root access, then stole seven <button class="define-target" id="private-key">private keys</button> that were reportedly accidentally stored in a backup. Several of the keys were sufficient to satisfy <button class="define-target" id="multisig">multisignature</button> requirements, which are intended to prevent private key leaks from allowing attackers to gain control over sensitive infrastructure like <button class="define-target" id="bridge">bridges</button>. With multisignature wallets, keys are supposed to be stored separately across multiple individuals and devices; however, in this case, attackers only needed to compromise one laptop to gain control over multisig-protected contracts.<p>With the keys, the attacker stole more than 6&nbsp;million of Humanity's H token, then used other keys to upgrade a bridge and drain 141&nbsp;million more tokens. With the bridge access, they also <button class="define-target" id="mint">minted</button> 300&nbsp;million new H tokens. The attacker then quickly swapped the ill-gotten tokens for ETH, causing the H price to plummet by 80–90%.</p><p>Humanity Protocol markets itself as a competitor to Sam Altman's <a href="https://www.web3isgoinggreat.com/?collection=worldcoin" target="_blank">World</a> (formerly Worldcoin), a decentralized identity project that aims to use iris scans to prove that users are unique humans. Humanity raised $20&nbsp;million in 2025 from Pantera Capital and Jump Crypto.</p>

"Explained: The Humanity Protocol Hack (June 2026)"

"Humanity's $36 million exploit tied to compromised laptop hosting a 'multisig' wallet"

Humanity Protocol theft

Humanity Protocol loses $36&nbsp;million to employee laptop compromise

Aztec Connect, an abandoned defi privacy bridge from Aztec Labs, was drained of $2.1&nbsp;million after an attacker exploited a bug in the project's smart contracts. Although the project was deprecated three years ago, funds remained in the legacy system. "Aztec Labs holds no admin keys or control over the system; it cannot be paused or upgraded by us," the project posted on social media.<p>The theft is only the latest in a string of attacks targeting vulnerable legacy smart contracts, many of which cannot be deleted, paused, or changed due to blockchains' immutable nature. <a href="https://www.web3isgoinggreat.com/?id=raydium-legacy-smart-contract-exploit" target="_blank">Raydium</a> and <a href="https://www.web3isgoinggreat.com/?id=dxsale-exploit" target="_blank">DxSale</a> are two other platforms that have recently suffered losses due to old, insecure code.</p>

"Aztec Connect’s abandoned smart contract exploited for $2.1M"

Aztec Connect exploit

Deprecated project Aztec Connect exploited for $2.1&nbsp;million

An attacker exploited a legacy <button class="define-target" id="smart-contract">smart contract</button> that had been used by the Raydium Solana <button class="define-target" id="dex">DEX</button> before it was deprecated in 2021. Though the contract was unused, there were still funds in the <button class="define-target" id="liquidity-pool">liquidity pools</button> affected by the vulnerable contract. Using fake LP tokens, the exploiter was able to trick an old smart contract with insufficient validation into allowing them to withdraw assets.<p>Raydium has said it will compensate users who lost funds in the exploit.</p>

"Raydium Confirms $1.34M Drain on Deprecated AMM V3, Pledges Treasury Compensation"

Event	Date	Amount More info
Humanity Protocol theft	June 9, 2026	$36,000,000
Aztec Connect exploit	June 15, 2026	$2,100,000
Raydium legacy smart contract exploit	June 10, 2026	$1,340,000