Humanity Protocol hack: Quantstamp links $36M theft to DPRK phishing malware
Quantstamp reports the Humanity Protocol hack resulted in the theft of $36M in H tokens, with evidence pointing to suspected North Korean (DPRK) threat actors.
The attack started via a phishing email that masqueraded as a token lockup schedule update from South Korean exchange Bithumb. Quantstamp says a compromised employee’s laptop was used, and the malicious attachment installed malware granting full remote access.
A key claim is that the malware was signed using a South Korean Hancom digital certificate, a pattern Quantstamp described as “characteristic of DPRK intrusions.” The malware then enabled attackers to copy Humanity Protocol director Chong Yee Wai’s MetaMask wallet credentials and private keys, facilitating the H token theft.
Quantstamp’s Humanity Protocol hack assessment comes alongside broader metrics of DPRK-linked cybercrime. A CertiK report estimates that North Korea-linked actors were tied to at least $578M of $634M in crypto thefts in April, and about $2B of $3.4B lost to crypto exploits in 2025 (12% of incidents). CertiK also says DPRK has “industrialized” crypto theft as a state revenue mechanism, with an estimated $6.75B stolen across 263 documented incidents over the past decade.
While North Korea rarely responds to allegations, a May statement rejected US claims of a “non-existent ‘cyber threat’.”
For traders, this Humanity Protocol hack reinforces counterparty and wallet-security risk premia, especially for teams with exposure to phishing and endpoint compromise.
Neutral
Quantstamp’s findings highlight a targeted security breach (phishing → endpoint compromise → MetaMask key theft) tied to DPRK-style intrusion patterns. This is likely to be seen as an idiosyncratic, risk-management issue for affected ecosystems rather than a systemic market shock.
In the short term, such “$X million hack” headlines can pressure liquidity and increase volatility for the specific token (H) and for custody/wallet/security-sensitive narratives. However, broad BTC/ETH typically show limited directional impact unless the incident threatens major infrastructure, stablecoins, or multiple large exchanges.
Historically, major attribution-based hack reports (e.g., Lazarus-linked events) often trigger brief risk-off sentiment and a rotation toward safer majors, but they rarely change longer-term market structure by themselves. Over the longer term, persistent DPRK-related theft statistics tend to keep traders focused on security disclosures, wallet hygiene, and institutional-grade controls, which can influence valuations at the margin rather than cause a sustained bear market.