Humanity Protocol’s H token has reportedly plunged nearly 90% after wallets tied to the project were drained of more than $32 million, according to onchain sleuth ZachXBT. In a twist that raises uncomfortable questions for incident response, ZachXBT also floated the idea that the attack may have been “possibly staged.”

What happened, on-chain

The breach hit Humanity Protocol, an identity-verification network, early on June 9. Bitcoin.com reports that the incident began as a private key breach. In practical terms, the damage landed fast. Wallets connected to the project were drained of more than $32 million, and the token selloff followed.

A key detail in the Bitcoin.com account is timing. The exploit was not described as a slow bleed or a series of small drains. It was framed as an early June 9 event where funds moved out of wallets tied to Humanity Protocol.

Why “possibly staged” matters

ZachXBT’s claim of “possibly staged” is not a comfort blanket. It is a hypothesis that changes what investigators look for next.

If an incident is staged, the simplest explanation shifts from “external attacker drained keys” to “insider access, compromised operational security, or coordinated misdirection.” That does not absolve external threats. It does mean the most important question becomes provenance. Who had access. When did access appear. And what on-chain signals match coercion, automation, or pre-positioned liquidity.

insider access, compromised operational security, or coordinated misdirection.

The report does not provide the underlying evidence for that staging theory in the excerpt we have here. So readers should treat it as an allegation. But the allegation alone is enough to warn teams not to lock into a single narrative too early.

The token crash follows drained wallets

Bitcoin.com ties the H token’s near 90% drop to the drained wallets. That linkage matters because it shows markets responding to custody failure, not just to a vague “security incident.”

From a risk standpoint, a private key breach points to operational controls as the weak link. Once project-controlled wallets lose keys, the project cannot reliably move funds, pause transactions, or roll back damage. Token holders then treat the situation as a probability-of-further-loss problem, not a one-time event.

What teams usually need to answer next

When an incident is framed as a private key breach, responders typically need to show their work.

Bitcoin.com’s account, as provided, stops short of detailing whether Humanity Protocol has disclosed: which wallet(s) were compromised, how the keys were stored, whether signing infrastructure was exposed, or what mitigations were activated after the first outflows.

And if ZachXBT’s “possibly staged” suggestion gains traction, investigators will want more than a post-mortem. They will want timeline-level clarity, including access logs if any exist off-chain, plus an on-chain trace of how funds moved immediately after the breach.

The unanswered questions readers should watch

As of this report, the core confirmed facts are straightforward. Humanity Protocol’s H token fell sharply. Wallets tied to the project were drained of more than $32 million. The incident started early on June 9.

The contested piece is motive and method. ZachXBT’s “possibly staged” framing is the part that should drive further scrutiny, not panic. It also underscores a grim reality for crypto security. Big losses are often followed by a messy blend of forensics and speculation. The difference between the two is the evidence.

For now, Humanity Protocol’s next steps will matter more than the token chart. Disclosure quality, wallet-by-wallet accounting, and a defensible timeline will decide whether this becomes a straightforward custody failure or a bigger story about who had access before the doors broke.