Humanity Protocol Hack Tooling Linked to North Korean Hackers: Quantstamp

A fake Bithumb email used in the $36 million Humanity Protocol hack points to the involvement of North Korean threat actors, according to Quantstamp. A malicious attachment delivered through a phishing email points to the involvement of North Korea-linked threat actors in Humanity Protocol's recent hack, according to blockchain security company Quantstamp. The decentralized identity company said [a compromised employee's laptop](https://cointelegraph.com/news/humanity-protocol-laptop-bridge-exploit-h-token) enabled attackers to steal $36 million in Humanity (H) tokens on Monday. The malicious attachment was disguised as a token lockup schedule update from South Korean cryptocurrency exchange Bithumb. It installed malware that gave attackers full remote access to the laptop, Quantstamp said in its incident response. _The phishing email that led to the Humanity Protocol compromise. The suspected North Korean link would add to a series of major crypto thefts attributed to the country. North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in [crypto-related incidents in April](https://cointelegraph.com/features/north-korean-hackers-578m-april-kelp-dao-exploit). According to a May report by blockchain security company CertiK, the same actors have been linked to about $2 billion of the $3.4 billion [lost to crypto exploits in 2025](https://cointelegraph.com/news/north-korea-industrialized-crypto-theft-laundered-billions-report-finds), while accounting for 12% of total incidents. CertiK said the figures reflect a focus on “precision and scale.” Over the past decade, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents, the [report](https://indd.adobe.com/view/595e40e3-3953-4d4b-aeaa-3e9954d5d844) said.