Two Operational Failures Drain Roughly $46 Million as Exploit Losses Persist

Two recent incidents show how operational mistakes, not unusual code flaws, cause much of the money lost in crypto. Humanity Protocol, an identity network, lost an estimated $36 million after an attacker compromised a developer machine and recovered seven private keys that had been backed up to that single device during the mainnet launch. Those keys included an admin wallet and several owners of the project's multi-signature wallets across Ethereum and BNB Chain. With them, the attacker seized control of token bridges and created or removed hundreds of millions of H tokens. The token fell roughly 80% on the day. No smart-contract bug was involved. The attacker simply held legitimate keys.

The Syscoin bridge lost an estimated $10 million to a different cause. The bridge's relay process accepted an invalid proof because of a parsing error in its proof-validation code, which let the attacker withdraw about 5 billion SYS on one side without destroying the matching tokens on the other. Both cases fall into categories the security community has identified repeatedly this year, key custody and bridge proof checks.

Beyond the two largest events, the DeFiHackLabs repository added reproductions this week of several smaller incidents, including a presale contract drain and an attack on a deprecated contract, the routine background losses that rarely receive public attention.