Humanity Protocol, a decentralized identity project that uses palm scans to try to prove that users are human, has suffered a $36&nbsp;million loss after attackers compromised a laptop belonging to an employee. After the laptop was infected with malware, the malicious code gained root access, then stole seven <button class="define-target" id="private-key">private keys</button> that were reportedly accidentally stored in a backup. Several of the keys were sufficient to satisfy <button class="define-target" id="multisig">multisignature</button> requirements, which are intended to prevent private key leaks from allowing attackers to gain control over sensitive infrastructure like <button class="define-target" id="bridge">bridges</button>. With multisignature wallets, keys are supposed to be stored separately across multiple individuals and devices; however, in this case, attackers only needed to compromise one laptop to gain control over multisig-protected contracts.<p>With the keys, the attacker stole more than 6&nbsp;million of Humanity's H token, then used other keys to upgrade a bridge and drain 141&nbsp;million more tokens. With the bridge access, they also <button class="define-target" id="mint">minted</button> 300&nbsp;million new H tokens. The attacker then quickly swapped the ill-gotten tokens for ETH, causing the H price to plummet by 80–90%.</p><p>Humanity Protocol markets itself as a competitor to Sam Altman's <a href="https://www.web3isgoinggreat.com/?collection=worldcoin" target="_blank">World</a> (formerly Worldcoin), a decentralized identity project that aims to use iris scans to prove that users are unique humans. Humanity raised $20&nbsp;million in 2025 from Pantera Capital and Jump Crypto.</p>

"Explained: The Humanity Protocol Hack (June 2026)"

"Humanity's $36 million exploit tied to compromised laptop hosting a 'multisig' wallet"

Humanity Protocol theft

Humanity Protocol loses $36&nbsp;million to employee laptop compromise

The bridge between the Cosmos-based Secret network and Axelar network was exploited via an infinite <button class="define-target" id="mint">mint</button> bug that went unnoticed for a week. An attacker exploited a smart contract in order to mint a large quantity of <button class="define-target" id="wrapped-token">wrapped</button> Axelar tokens on the Secret network, which they then redeeemed for around $4.67&nbsp;million.<p>The exploit, which occurred on June 10, went unnoticed until June 17, when a transaction failed with a message suggesting that more tokens had been bridged out of the Secret network than had been bridged in.</p><p>Secret has warned, "If you hold Axelar-bridged saXXX tokens on Secret, please be aware their backing was affected and your funds may be lost."</p>

"Secret Network bridge exploited for $4.7M with 'infinite mint' bug"

Secret bridge exploit

Secret bridge exploited for $4.67&nbsp;million a week before anyone notices

Aztec Connect, an abandoned defi privacy bridge from Aztec Labs, was drained of $2.1&nbsp;million after an attacker exploited a bug in the project's smart contracts. Although the project was deprecated three years ago, funds remained in the legacy system. "Aztec Labs holds no admin keys or control over the system; it cannot be paused or upgraded by us," the project posted on social media.<p>The theft is only the latest in a string of attacks targeting vulnerable legacy smart contracts, many of which cannot be deleted, paused, or changed due to blockchains' immutable nature. <a href="https://www.web3isgoinggreat.com/?id=raydium-legacy-smart-contract-exploit" target="_blank">Raydium</a> and <a href="https://www.web3isgoinggreat.com/?id=dxsale-exploit" target="_blank">DxSale</a> are two other platforms that have recently suffered losses due to old, insecure code.</p>

"Aztec Connect’s abandoned smart contract exploited for $2.1M"

Aztec Connect exploit

Deprecated project Aztec Connect exploited for $2.1&nbsp;million

Three days after Aztec Labs' deprecated Aztec Connect blockchain <button class="define-target" id="bridge">bridge</button> was <a href="https://www.web3isgoinggreat.com/?id=aztec-connect-exploit" target="_blank">exploited</a> for $2.1&nbsp;million, the project has been hacked again for the same amount. Aztec Labs confirmed the second exploit, again trying to emphasize that the code was deprecated four years ago.<p>The hacks are part of a <a href="https://www.web3isgoinggreat.com/?collection=legacy-exploit" target="_blank">spate of exploits</a> targeting legacy smart contracts belonging to projects including <a href="https://www.web3isgoinggreat.com/?id=raydium-legacy-smart-contract-exploit" target="_blank">Raydium</a> and <a href="https://www.web3isgoinggreat.com/?id=dxsale-exploit" target="_blank">DxSale</a>. Although some projects have developed techniques to circumvent the immutable nature of blockchains and allow smart contracts to be upgraded or retired, many legacy contracts cannot be changed or shut down, leaving them vulnerable to attack indefinitely.</p>

Aztec hack #2

Aztec Connect hacked for a second time in less than a week

The Taiko <button class="define-target" id="bridge">bridge</button>, which allows assets to be transferred between the Ethereum mainnet and the Taiko Ethereum <button class="define-target" id="layer-2">layer-2</button> chain, was exploited for at least $1.7&nbsp;million before the network was halted, limiting losses. An attacker was able to forge withdrawal requests to appear as though they matched real deposits. Crypto security firm BlockSec said that the attacker may have gained access to a signing key that had been exposed on GitHub.

Taiko bridge exploit

Taiko bridge exploited

An attacker exploited a legacy <button class="define-target" id="smart-contract">smart contract</button> that had been used by the Raydium Solana <button class="define-target" id="dex">DEX</button> before it was deprecated in 2021. Though the contract was unused, there were still funds in the <button class="define-target" id="liquidity-pool">liquidity pools</button> affected by the vulnerable contract. Using fake LP tokens, the exploiter was able to trick an old smart contract with insufficient validation into allowing them to withdraw assets.<p>Raydium has said it will compensate users who lost funds in the exploit.</p>

"Raydium Confirms $1.34M Drain on Deprecated AMM V3, Pledges Treasury Compensation"

Event	Date	Amount More info
Humanity Protocol theft	June 9, 2026	$36,000,000
Secret bridge exploit	June 10, 2026	$4,670,000
Aztec Connect exploit	June 15, 2026	$2,100,000
Aztec hack #2	June 18, 2026	$2,100,000
Taiko bridge exploit	June 22, 2026	$1,700,000
Raydium legacy smart contract exploit	June 10, 2026	$1,340,000