According to BlockBeats, on June 9, Humanity revealed that the attack was not caused by smart contract vulnerabilities but by compromised private keys resulting from unsafe key management practices. The company stated that production signing keys were improperly backed up on a general-purpose development machine instead of isolated hardware devices, constituting an operational security failure.
Humanity is conducting forensic investigations with external security experts to determine how the device was compromised and the exact timeline of the breach. The company is simultaneously drafting compensation and fund recovery options for affected users and preparing a token contract update plan, with details to be announced once finalized.