A malicious attachment delivered through a phishing email points to the involvement of North Korea-linked threat actors in Humanity Protocol’s recent hack, according to blockchain security company Quantstamp.<\/p>\n
The decentralized identity company said a compromised employee’s laptop<\/a> enabled attackers to steal $36 million in Humanity (H) tokens on Monday. <\/p>\n The malicious attachment was disguised as a token lockup schedule update from South Korean cryptocurrency exchange Bithumb. It installed malware that gave attackers full remote access to the laptop, Quantstamp said in its incident response.<\/p>\n \n The phishing email that led to the Humanity Protocol compromise. Source: Quantstamp<\/em><\/p>\n Quantstamp added that the malware was signed with a South Korean Hancom digital certificate, a pattern it described as \u201ccharacteristic of DPRK intrusions.\u201d The malware enabled attackers to copy Humanity Protocol director Chong Yee Wai’s MetaMask wallet credentials and private keys.<\/p>\n The suspected North Korean link would add to a series of major crypto thefts attributed to the country. North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in crypto-related incidents in April<\/a>. <\/p>\n According to a May report by blockchain security company CertiK, the same actors have been linked to about $2 billion of the $3.4 billion lost to crypto exploits in 2025<\/a>, while accounting for 12% of total incidents. CertiK said the figures reflect a focus on \u201cprecision and scale.\u201d<\/p>\n Over the past decade, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents, the report<\/a> said.<\/p>\n Related: <\/strong><\/em>CZ sounds alarm as \u2018SEAL\u2019 team uncovers 60 fake IT workers linked to North Korea<\/strong><\/em><\/a>\u00a0<\/strong><\/em><\/p>\n CertiK added that North Korea has \u201cindustrialized\u201d crypto theft into a core state revenue mechanism, making these operations a substantial share of the regime\u2019s external income.<\/p>\n \n Total DPRK crypto theft over the years. Source: CertiK\/Skynet<\/em><\/p>\n North Korea rarely responds to cybercrime allegations, but on May 3, a Foreign Ministry spokesperson rejected them in a statement<\/a> carried by the Korean Central News Agency, the country’s state media.<\/p>\n The spokesperson accused the US of spreading \u201cincorrect\u201d narratives about the \u201cnon-existent \u2018cyber threat\u2019\u201d from North Korea. <\/p>\n Magazine: <\/strong><\/em>Coinbase hack shows the law probably won\u2019t protect you \u2014 Here\u2019s why<\/strong><\/em><\/a> <\/strong><\/em><\/p>\n<\/div>\nNorth Korean hackers tied to some of the largest crypto hacks<\/h2>\n
![\"\"](\"https:\/\/s3-images.ctmedia.io\/media\/content\/pasted-image-1468.png\")
<\/figure>\n<\/p>\n