Humanity: is currently developing a fund recovery or compensation plan, as well as a token contract update plan

BlockBeats message, June 9: Humanity released an update on the attack incident. This incident was not the result of a smart contract vulnerability. The bridge, the tokens themselves, or the Safe system had no vulnerabilities. Every action carried out by the attacker—including transfers, Safe transactions, and proxy contract upgrades—was authorized through legitimate private key access.

The reason this attack was able to occur is entirely due to the leakage of private keys, and the root cause lies in unsafe key management practices: the keys used to sign in the production environment were backed up on a general-purpose development machine, without being protected by isolated hardware devices. This is a security lapse at the human and operational level.

At present, Humanity is still confirming how the device was compromised and the specific timeline of when the attacker gained access. We have already hired external security experts to conduct a forensic investigation of the compromised device. As the investigation progresses, Humanity will disclose more updates to the community. Meanwhile, Humanity is also developing a plan to recover funds from or compensate affected users, and is actively working on a token contract update plan. Once the relevant details are confirmed, it will be published promptly.