Is Humanity Protocol's $32M Hack an Exit Scam? What ZachXBT's Investigation Reveals

On-chain investigator ZachXBT and analyst Elton allege Humanity Protocol’s $32 million hack was potentially staged, citing pre-funded attacker wallets, suspicious token dumps, and coordinated activity across blockchains. The project’s founder, Terence Kwok, has launched a new venture called 'Everything,' raising $6.9 million in seed funding through Humanity Investments, while his prior startup, Tink Labs, collapsed into insolvency after raising $170 million.
On-chain investigator ZachXBT and analyst Elton have raised concerns that Humanity Protocol’s $32 million hack on June 9, 2026, may have been orchestrated as an exit scam. Their analysis highlights unusual patterns, including attacker wallets created and funded weeks before the exploit, a minting authority that appeared pre-warmed, and all stolen H tokens dumped exclusively through decentralized exchanges like Kyber Network and PancakeSwap. The team behind Humanity Protocol confirmed a foundation member’s private key was compromised, leading to a 90% token crash. However, ZachXBT noted suspicious pre-hack activity, including a token rally to $0.85 just before the breach, which he called 'crime pumping.' Analyst Elton also documented coordinated dumps across Ethereum and BNB Chain, suggesting insider involvement or advanced planning. The Humanity team has already pivoted to a new project, 'Everything,' an all-in-one exchange platform that raised $6.9 million in seed funding led by Humanity Investments. Founder Terence Kwok previously led Tink Labs, a Hong Kong startup that raised $170 million in venture capital before collapsing into insolvency. Critics argue the new funding round and quick transition raise further doubts about the legitimacy of the hack narrative. ZachXBT dismissed the team’s official story, stating it provided a convenient exit for an active market maker. Independent analysts have echoed skepticism, pointing to the lack of funds moving through centralized exchanges—a rare pattern in genuine exploits—and the operational sophistication of the attack. The investigation continues as the crypto community debates whether this was a genuine breach or a coordinated exit strategy.
This content was automatically generated and/or translated by AI. It may contain inaccuracies. Please refer to the original sources for verification.