Humanity Hacker Mints 100M Tokens, Converts to BNB as Exploit Losses Top $20M

An ongoing security exploit targeting the Humanity (H) token ecosystem has escalated significantly, with on-chain data revealing that the attacker has minted 100 million new H tokens and begun converting them into Binance Coin (BNB). The development marks a major escalation in what analysts describe as a coordinated attack on wallets that have previously interacted with the Humanity project.

On-Chain Evidence of Token Minting and Swap

Blockchain analyst Specter reported on Monday that the hacker, or a group acting in coordination, executed a smart contract function to mint 100 million H tokens directly into a controlled wallet. Within hours, a portion of these tokens was swapped for BNB via decentralized exchange aggregators, suggesting the attacker is attempting to liquidate the illicitly obtained assets.

The minting event was detected through real-time on-chain monitoring tools, which flagged an unusual spike in H token supply. Specter’s analysis indicates that the hacker has been systematically targeting wallets that have previously interacted with Humanity’s smart contracts, draining funds and now exploiting the token’s minting mechanism.

Exploit Timeline and Cumulative Damage

According to Specter’s earlier reports, the attack has been ongoing for several days, with the hacker continuously draining tokens from compromised wallets. Cumulative losses across all affected addresses are now estimated to exceed $20 million, making this one of the more significant exploits in the decentralized finance (DeFi) sector this year.

The attacker’s method appears to involve exploiting a vulnerability in the Humanity token contract, allowing unauthorized minting. Security researchers are still analyzing the exact vector, but preliminary findings suggest a flaw in the contract’s access control logic may have been the entry point.

Implications for Token Holders and the DeFi Ecosystem

This incident underscores persistent risks in the DeFi space, particularly around smart contract security and tokenomics. For Humanity token holders, the sudden inflation of supply through unauthorized minting could lead to significant price dilution and loss of value. The conversion to BNB, a highly liquid asset, indicates the attacker is prioritizing exit liquidity over long-term control.

Security experts recommend that anyone who has interacted with Humanity-related smart contracts immediately revoke token approvals and move remaining assets to cold storage. The incident also raises questions about the auditing and security practices of newer token projects, which may lack the rigorous testing seen in more established protocols.

Conclusion

The Humanity hack, now involving the minting of 100 million H tokens and their conversion to BNB, represents a serious breach of trust and security in the DeFi ecosystem. With losses surpassing $20 million and the attacker actively liquidating assets, the incident serves as a stark reminder of the importance of robust smart contract auditing and proactive security measures for both projects and users. The broader crypto community will be watching closely for further developments, including potential exchange blacklisting of the attacker’s addresses and any recovery efforts.

FAQs

Q1: How did the hacker mint 100 million H tokens?
A1: The attacker exploited a vulnerability in the Humanity token’s smart contract, likely related to access control, which allowed unauthorized minting of new tokens directly into their wallet.

Q2: What is the total damage from this exploit?
A2: On-chain analyst Specter reports cumulative losses exceeding $20 million, including both direct wallet drains and the newly minted tokens being swapped for BNB.

Q3: What should Humanity token holders do to protect themselves?
A3: Users should immediately revoke any token approvals granted to Humanity-related smart contracts, move funds to cold storage, and monitor official project channels for further instructions. Avoid interacting with the project’s contracts until the vulnerability is confirmed patched.