Provide a concise narrative that clearly states each of (a)–(e) below.
Humanity Protocol builds decentralized identity infrastructure to let users prove they are human and verify identity attributes without revealing personal data. The protocol targets fraud, Sybil abuse, and fragmented digital identity systems that allow bots and fake accounts to pollute blockchain networks, governance systems, and online platforms.
(Source: Protocol Overview, Fairdrop Launch, Whitepaper)
Humanity Protocol's ongoing operating focus spans: broadening Human ID onboarding through mobile and palm-scan enrollment; expanding Proof of Trust integrations with third-party applications; supporting developer adoption through SDK, API, and Verification Oracle surfaces; funding ecosystem growth through the Ecosystem Fund and Foundation Treasury; and supporting validator and staking participation through incentive programs.
(Source: Humanity App Launch, Build with Humanity, Credentials Verification Service, Strategic Funding, Staking Program)
Humanity Protocol is a zkEVM Layer 2 blockchain built on the Polygon Chain Development Kit. The protocol initially centered on Proof of Humanity via palm biometrics and zero-knowledge proofs for unique-human verification. The public product surface has since expanded toward a Proof of Trust framework built on decentralized identifiers, verifiable credentials, mobile Human ID onboarding, and on-chain credential checks through a Verification Oracle. Validators issue credentials, zkProofers generate privacy-preserving verification proofs, and applications pay verification fees in $H.
(Source: Protocol Overview, Build with Humanity, Credentials Verification Service, Humanity App Launch, Whitepaper)
$H is the network's native ERC-20 token with a fixed supply of 10,000,000,000 tokens. Publicly described uses include: validator staking to issue credentials; zkProofer incentives for generating verification proofs; application-level verification fees paid to protocol participants; governance participation via Snapshot-based voting; identity-related rewards; and staking participation tied to future fees generated by identity validators and verification services.
(Source: H Token, Fairdrop Launch, MiCA Disclosure, Staking Program, Delphi Digital)
$H governance currently operates via Snapshot off-chain voting with execution enforced through a Human Institute 3-of-5 multisig. A proposal passes when at least 10,000,000 $H participate and at least 50% of voting tokens favor the proposal. A 5-to-10-day discussion period precedes voting. All voting history, validator lists, treasury wallets, and upgrade schedules are published on-chain and on GitHub. The protocol is transitioning toward a broader Proof of Trust governance framework, though a full on-chain admin-threshold map has not been publicly disclosed.
(Source: MiCA Disclosure, Whitepaper, Delphi Digital)
For each existing entity: Labs/DevCo (e.g., Founder, CEO, CTO, COO), Foundation (e.g., President, Executive Director, CFO, COO), and DAO / onchain governance leadership (if applicable) list the: (a) full names, (b) official titles, (c) and prior experience of key team members. For any non-existent entity, explicitly mention it does not exist. External links may be included but they will not factor into the score.
Full Name | Entity | Official Title | Prior Experience |
|---|---|---|---|
Terence Kwok. | Labs | Founder and CEO, Humanity Protocol | Tech entrepreneur; founder of Humanity Protocol; previously founded a separate venture that publicly experienced difficulty. |
Yat Siu | Foundation | Founding Director, Humanity Foundation | Chairman of Animoca Brands. |
Mario Nawfal | Foundation | Founding Director, Humanity Foundation | Founder of International Blockchain Consulting. |
Yeewai Chong | Foundation | Interim CEO and Founding Director, Humanity Foundation | Previously held investment roles at Morgan Stanley and Ortus Capital; holds a Ph.D. in economics from Stanford University. |
No separate DAO or on-chain governance officer roster has been identified. Public sources reference governance participation through $H token voting and a council of Founding Humans that includes Yat Siu and Sandeep Nailwal. Governance proposals currently execute via the Human Institute's 3-of-5 multisig rather than an autonomous on-chain executor. | DAO | ||
Blockworks note: (Source: Launch Announcement, Seed Funding, DL News, Foundation Launch, Biometric Update, MiCA Disclosure, Delphi Digital) |
Provide a structured description of the DAO's governance, powers, and economic rights. If a DAO does not exist, state so. Address the lettered items below. Even if there is no DAO, there must be an answer to (d).
No public disclosure of which entity owns or controls Humanity Protocol's codebases, repositories, or trademarks has been identified in the reviewed source set.
Governance operates via Snapshot off-chain voting. A proposal requires a minimum of 10,000,000 $H participating and a simple majority (50%+) in favor to pass. After passage, the Human Institute executes through a 3-of-5 multisig, typically within 7 days. The Human Institute cannot block or modify approved proposals. All voting history, validator lists, treasury wallets, and upgrade schedules are published on-chain and on GitHub. This structure means execution authority currently rests with the Human Institute multisig rather than an autonomous on-chain executor.
(Source: MiCA Disclosure, Whitepaper, Delphi Digital)
Public sources disclose validator staking, a public staking program, and governance-linked token utility. Validators must stake $H to issue credentials. Users may stake $H to back trusted validators and earn delegated staking rewards. Governance voting requires $H holdings at the time of the proposal snapshot. No separate locked-token governance-rights schedule beyond these public references has been identified in the reviewed source set.
(Source: MiCA Disclosure, Whitepaper, Staking Program)
$H does not grant equity, profit-sharing, or redemption rights. No rights are guaranteed or enforceable against the issuer. Token utility is functional: holders may pay verification fees, stake to participate in validation, vote on governance proposals, and earn verification rewards as node operators.
(Source: MiCA Disclosure)
No public disclosure of dissolution authority or wind-up mechanism for the protocol's governance structure has been identified.
For the Primary Foundation do the following independently. If an entity does not exist, state that explicitly. Items (a)–(f) apply only if that entity exists; state explicitly that the entity doesn't exist. Definitions: The primary Foundation and DevCo can be explained as those entities which are directly involved in the issuance of the native token at launch.
Humanity Foundation is described as a not-for-profit entity. Its jurisdiction of incorporation has not been publicly disclosed in the reviewed source set.
No public disclosure identifying IP, codebases, repositories, or trademarks controlled by Humanity Foundation has been identified.
The Foundation holds the 12% Foundation Operations Treasury allocation (1,200,000,000 $H), 50% of which was unlocked at TGE, with the remainder vesting over 48 months. Public sources describe this treasury as funding grants, governance, and ecosystem programs. No public disclosure of formal powers over DAO governance thresholds, protocol-controlled resources, token minting or burning authority, or reward parameter control has been identified.
No public disclosure describing whether the Humanity Foundation holds formal authority over Human Institute Limited's decision-making has been identified.
No public disclosure of Foundation-specific pause, upgrade, or governance-executor authorities has been identified.
The Foundation's 12% allocation (1,200,000,000 $H) funds grants, governance, and ecosystem programs per public tokenomics disclosures. No governance-approved, contractual, or programmatic mechanisms directing protocol revenue, fees, or additional token distributions to the Foundation, its directors, or contributors have been publicly disclosed.
Blockworks note: The cited materials identify Humanity Foundation as an existing ecosystem entity. Founding directors are Yat Siu, Mario Nawfal, and Yeewai Chong, with Chong serving as interim CEO. Public sources describe Humanity Foundation as a not-for-profit entity formed to invest in projects that leverage Humanity Protocol's Proof of Humanity, fund research and development, and support ecosystem growth.
(Source: Foundation Launch, Biometric Update)
For the Primary DevCo do the following independently. If an entity does not exist, state that explicitly. Items (a)–(f) apply only if that entity exists; state explicitly that the entity doesn't exist. Definitions: The primary Foundation and DevCo can be explained as those entities which are directly involved in the issuance of the native token at launch.
Human Institute Limited is a private company incorporated under the laws of the British Virgin Islands.
(Source: Terms and Conditions)
No public disclosure identifying specific IP, codebases, repositories, or trademarks controlled by Human Institute Limited, or its subsidiary structure, has been identified.
Human Institute Limited operates the 3-of-5 multisig that executes passed governance proposals. This gives Human Institute Limited de facto execution authority over protocol upgrades and administrative actions that have passed a governance vote. The Human Institute cannot block or modify approved proposals. Beyond multisig execution, no further public disclosure of DevCo powers over treasury actions, token minting authority, or reward parameter control has been identified.
(Source: Delphi Digital, Terms and Conditions)
No public disclosure describing whether Human Institute Limited holds formal authority over Humanity Foundation's decision-making has been identified.
Human Institute Limited controls the 3-of-5 multisig used to execute governance-approved proposals. The June 8–9, 2026 exploit confirmed that Human Institute's administrative infrastructure also included Safe multisig signers across Ethereum and BNB Smart Chain used for bridge administration, with the attacker exploiting compromised Safe owner keys stored on a malware-infected developer machine to seize ProxyAdmin control of the token bridges.
(Source: Delphi Digital, The Defiant, CoinDesk Post-Mortem)
Human Institute Limited holds a 5% Human Institute Strategic Reserves allocation (500,000,000 $H), subject to a 12-month cliff and 18-month linear vest, with 5% unlocked at TGE. No governance-approved, contractual, or programmatic mechanisms directing protocol revenue, fees, or additional token distributions to Human Institute Limited, its equityholders, or contributors have been publicly disclosed.
(Source: H Token)
Blockworks note: The cited materials identify Human Institute Limited as the Company under Humanity's terms and conditions. Human Institute Limited is incorporated under the laws of the British Virgin Islands. The terms describe the company's services as including the Protocol, identity verification through palm print and vein image recognition, verifiable credential issuance, data encryption, an SDK for third-party builders, and other products or services made available through the platform or in connection with the Protocol.
(Source: Terms and Conditions)
Disclose launch and initial supply details in a single initial allocation schedule covering the token's launch.
$H is an ERC-20 token with a fixed total supply of 10,000,000,000 tokens, all minted at genesis. Approximately 1,825,000,000 $H (18.25% of total supply) was unlocked at TGE, leaving 8,175,000,000 $H (81.75%) locked and releasing per the schedules in (f). The TGE-unlocked figure reconciles to three sources: Community Incentives in full (1,200,000,000 $H), 50% of the Foundation Operations Treasury (600,000,000 $H), and 5% of Human Institute Strategic Reserves (25,000,000 $H). No other category released tokens at launch. (Source: H Token, Tokenomist)
Seven categories comprise the genesis supply: * Early Contributors (Team) — 19.00% (1,900,000,000 $H). Core team and early contributor compensation. * Investors — 10.00% (1,000,000,000 $H). Early backers. Per Messari, this bucket covers participants in the $30M seed round. * Community Incentives — 12.00% (1,200,000,000 $H). Community programs, hackathons, and Fairdrop distribution. * Human Institute Strategic Reserves — 5.00% (500,000,000 $H). Held by Human Institute Limited for future partnerships and strategic initiatives. * Foundation Operations Treasury — 12.00% (1,200,000,000 $H). Controlled by Humanity Foundation to fund grants, governance operations, and ecosystem programs. * Ecosystem Fund — 24.00% (2,400,000,000 $H). Integrations, developer incentives, and long-term protocol growth. * Identity Verification Rewards — 18.00% (1,800,000,000 $H). Incentivizes Human ID verification, zkProofer node operation, and ongoing proof maintenance. (Source: H Token, Messari)
No fixed offering price was set. $H launched on major exchanges on June 25, 2025 with price determined by the market on listing. The token opened near $0.029, briefly traded above $0.05 during initial listing activity, and reached an all-time low of approximately $0.018 by June 27, 2025. (Source: Fairdrop Launch, StealthEX)
$H (Source: H Token, MiCA Disclosure)
Fixed supply of 10,000,000,000 $H. No inflationary minting mechanism exists under the documented tokenomics. The June 8–9, 2026 exploit resulted in the unauthorized minting of approximately 300,000,000 additional $H on BNB Smart Chain via compromised ProxyAdmin keys, confirmed in the project's post-mortem. As of June 15, 2026, no token burn, supply cap restoration, or token migration has been announced, so the effective outstanding supply exceeds the documented cap. (Source: H Token, MiCA Disclosure, The Defiant Post-Mortem, CryptoTimes Post-Mortem)
Release terms by category, with circulating treatment: * Early Contributors (Team) — 0% at TGE; 12-month cliff, then 24-month linear vest. Circulating treatment: yes. * Investors — 0% at TGE; 12-month cliff, then 18-month linear vest. Circulating treatment: yes. * Community Incentives — 100% at TGE; no cliff, no vest. Circulating treatment: no. * Human Institute Strategic Reserves — 5% at TGE; 12-month cliff, then 18-month linear vest on the remainder. Circulating treatment: yes. * Foundation Operations Treasury — 50% at TGE; no cliff, remainder vests over 48 months. Circulating treatment: yes. * Ecosystem Fund — 0% at TGE; no cliff, 48-month vest. Circulating treatment: yes. * Identity Verification Rewards — 0% at TGE; 6-month cliff, then 42-month vest. Circulating treatment: yes. The next scheduled unlock is June 25, 2026, releasing tokens to Early Contributors at the expiry of the 12-month cliff. The full unlock schedule extends into 2029. (Source: H Token, Tokenomist)
Address each of the following sub-items based on the project's airdrop status. If a sub-item does not apply to the project's situation, state that explicitly.
Planned but not yet executed airdrop: Not applicable. Humanity Protocol executed its Fairdrop at TGE in June 2025. There is no planned-but-unexecuted airdrop, and accordingly no forward-looking commitment to publish a quarterly recipient wallet list is required under this sub-item. See (b) for the executed distribution.
Executed airdrop: Humanity Protocol executed a Fairdrop at TGE.
Covered user segments. Eligibility was determined by signals of real participation across five identified segments: users who completed Human ID verification; KAITO stakers; active Discord community participants; early testnet participants; and users who drove qualifying referrals. Builders and other network contributors were also referenced as covered participants.
Allocation method. Humanity published a public eligibility snapshot and operated a case-by-case appeal form for disputed exclusions. The relative weighting applied across the eligibility signals above — and whether allocations were flat per qualifying wallet or scaled by activity — has not been identified in the reviewed source set.
Claim mechanics. Wallet registration occurred during the eligibility flow. The eligibility/claim deadline was 9:00 UTC on June 24, 2025, with public claiming opening 9:00 UTC on June 25, 2025 through the claim interface at fairdrops.com. An optional 90-day staking path carrying a 25% bonus was available per the claim guide.
Per-address source. No per-address recipient list in CSV/TSV/JSON, Dune table, full Merkle dump, GitHub repo file embedding allocations, or RPC endpoint exposing claim/amount data has been identified in the reviewed source set.
(Source: Fairdrop Launch, Claim Guide, Eligibility)
No airdrop planned or conducted: Not applicable. An airdrop has been conducted — the TGE Fairdrop described in (b).
Blockworks note: Two gaps sit against full credit on this section. The binding one is the absence of a per-address source: sub-item (b) requires a pointer to claim/amount data at the address level, and the eligibility snapshot and claim interface do not satisfy it, since an interface is not a per-address dataset. A Merkle dump from the claim contract, a Dune table of claim events, or an RPC endpoint exposing claimed amounts would each close it on their own.
The second is the allocation method. Segments are disclosed clearly, but the method — how the five eligibility signals translated into per-wallet amounts — is not. Under the rubric, segments and method are both required for the executed-airdrop path, so this is a live gap even though it is not the one currently doing the damage.
Projects must disclose all material terms of market-making arrangements that affect token liquidity. If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. For each market maker, include in a table:
If the project has no agreements or deals with market makers, state that explicitly; doing so earns full credit. If no native tokens were loaned or allocated to market makers, state that explicitly; cash/fiat retainers or fees are not required for this item.
Blockworks note: No public disclosure of market-maker agreement terms, token loans, term durations, or structure names has been identified. On-chain investigator ZachXBT publicly noted suspicious market-making and OTC activity involving $H prior to the June 2026 exploit, and later assessed that the market-maker activity and the private key compromise appeared to be independent events. The project has not publicly confirmed or denied market-maker arrangements.
(Source: ZachXBT via crypto.news)
Projects must disclose all material terms of centralized or decentralized exchange listings that affect token liquidity. For each listing, include in a table:
If the project has no agreements or deals with CEX or DEX, state that explicitly; doing so earns full credit; cash/fiat fee amounts are not required for this item.
Blockworks note: Public sources identify the exchanges where $H was available at launch. Listing-term economics, token allocations committed for listing, and native token listing fee arrangements are not publicly disclosed.
(Source: Claim Guide, Fairdrop Launch)
Disclose all prior token sales by the Project — including fundraising rounds, any material OTC sales to investors, and any discounted market-maker sales. For each sale, provide:
If no prior sales occurred, state that explicitly (e.g., "No prior fundraising, OTC, or discounted MM sales have occurred.").
Blockworks note: Public MiCA disclosure materials state that the $H token was not sold in a public or private sale and that no preferential purchase pricing was offered to any party. Separate company-level fundraising disclosures identify three equity or equity-adjacent rounds. Humanity Protocol raised $30 million in a seed round in 2024 at a valuation of $1 billion, with investors including Kingsway Capital, Pantera Capital, Animoca Brands, Hashed, Shima Capital, and Jump Crypto. Humanity raised an additional $20 million from Pantera and Jump at a $1.1 billion fully diluted valuation in January 2025. A third round of undisclosed size was reported in January 2026.
(Source: Seed Funding Announcement, Strategic Funding, ICO Analytics, Tracxn, MiCA Disclosure)
If any, list prior exploits or incidents that directly affected the token, token supply, tokenholder balances, token contract, minting controls, burn mechanics, or custody of token supply. This question is not asking about general protocol, application, or smart contract exploits unless the incident directly affected the native token itself. If no prior incidents, state this explicitly (e.g., "No exploits affecting tokenholders or protocol funds as of YYYY-MM-DD").
2026-06-08 through 2026-06-09. Components affected: Ethereum token bridge, BNB Smart Chain token bridge, admin hot wallet, and BNB Smart Chain $H token contract ProxyAdmin.
A developer machine was infected with malware, giving the attacker root access and the ability to obtain seven private keys that had been unintentionally backed up to the device during the project's mainnet launch, including the admin hot wallet key and six Safe owner keys across Ethereum and BNB Chain. The attack proceeded in three waves. First, 6.04 million $H were drained from an Ethereum admin hot wallet after its key was compromised. The attacker then used three of the six Ethereum Safe owner keys to seize ProxyAdmin ownership of the bridge, upgraded the bridge to a malicious implementation, and drained 141.18 million $H in a single transaction. On BNB Smart Chain, three compromised Safe keys gave the attacker control of the token's ProxyAdmin, and three separate mint transactions of 100 million $H each expanded the circulating supply before those tokens were liquidated through decentralized exchanges. CoinpediaThe Defiant
The project's post-mortem placed the total unique impact at approximately 447 million $H tokens stolen or unauthorizedly minted. Stolen $H was swapped for approximately 16,320 ETH (approximately $27 million) across six attacker addresses. Total losses were estimated at $36 million across both chains. Users holding $H in personal wallets were not directly targeted; losses were concentrated in project-controlled treasuries, bridges, and administrative contracts. Crypto Times
In response, the protocol halted bridge deposits and withdrawals, published a live tracker of the exploiter's addresses, and offered a $1 million USDT bounty for information leading to asset recovery. Any recovered funds would go toward buying back $H tokens. The team coordinated with security firms, exchange partners, and law enforcement. A full post-mortem was published. A recovery program for affected users is described as under development with details not yet finalized.
(Source: The Defiant, CryptoTimes, CoinDesk, BeinCrypto)
Investigation ongoing as of June 15, 2026. Bridge deposits and withdrawals remain halted. The attacker retains ProxyAdmin control of the ERC-BSC bridge and the BSC $H token contract as of the post-mortem publication date. No funds have been publicly recovered. A user recovery program has been announced but not finalized. No token migration, supply cap restoration, or burn of unauthorized minted tokens has been announced. The project is cooperating with law enforcement.
(Source: CoinDesk Post-Mortem, The Defiant Full Post-Mortem, CryptoTimes Three Vectors, BeinCrypto Recovery Update)
Describe material risk factors across the three categories below. Each category includes prompts to address at a minimum.
(a) Regulatory, Legal & Tax Risks — Describe how evolving laws and regulations could affect the project by answering, at a minimum, questions like:
Impact of Regulatory Change on TGE and Listings: (If applicable) How could evolving or conflicting laws and regulations affect your ability to complete the TGE, deliver tokens to purchasers, and list or maintain the token on trading venues in key jurisdictions?
Entity-Level Regulatory Impact: (If applicable) How could regulatory or legal changes impact your core entities (Foundation, DevCo, DAO, affiliated service providers), including enforcement actions, licensing requirements, or forced changes to structure or operations?
Tokenholder Tax Treatment: (If applicable) What uncertainties exist around how tokenholders may be taxed, and make clear that tokenholders are responsible for understanding their own tax obligations?
Jurisdictional & User Access Restrictions: (If applicable) If the project restricts access for certain jurisdictions or user types (e.g., U.S. persons, sanctioned countries, retail vs. professional), what are those restrictions and what risks do they create for users and for the project?
(b) Protocol, Technology & Security Risks — Describe risks to network and contract reliability, correctness, and safety by answering, at a minimum, questions like:
Bugs and Design Flaws: (If applicable) What bugs, design flaws, or implementation errors could exist in your core protocol code, smart contracts, and any bridges, rollups, or oracles that you depend on, and how could these lead to loss of funds or disruption of the protocol?
Security Measures & Their Limitations: (If applicable) What security measures have you taken (audits, formal verification, bug bounties), and what types of failures might these measures still fail to detect or prevent?
(c) Token Economics, Unlocks & Incentive Risks — Describe how the token's economic design and supply schedule could affect holders by answering, at a minimum, questions like:
Critical Economic Assumptions: (If applicable) Which economic assumptions (e.g., staking yields, fee revenue, liquidity incentives, MEV capture, demand for blockspace) are critical for protocol security, utility, and governance, and what happens if those assumptions fail?
Governance Control over Monetary Policy & Rewards: (If applicable) To what extent can governance change monetary policy, fee parameters, or reward allocations (e.g., inflation rate, treasury flows, incentive programs), and how could such changes adversely affect tokenholders?
Public legal terms state that Humanity products and services are not available in certain jurisdictions due to regulatory restrictions, and users from prohibited jurisdictions or sanctions lists are not eligible to access the platform.
(Source: Terms and Conditions)
Human Institute Limited is a British Virgin Islands company. A separate MiCA-oriented issuer surface for $H indicates an evolving multi-entity regulatory perimeter around the token and service stack. Future listing access remains exposed to venue-level and jurisdiction-level legal changes following the token's launch on major exchanges on June 25, 2025.
(Source: Terms and Conditions, MiCA Disclosure, Fairdrop Launch)
Tax responsibility for transactions involving the platform and related virtual-asset activity rests with users under the public terms.
(Source: Terms and Conditions)
The June 8–9, 2026 exploit demonstrated that the protocol's administrative key management represented a material security failure. A developer machine infected with malware yielded seven private keys controlling bridge ProxyAdmin roles across Ethereum and BNB Smart Chain. The attacker drained approximately 447 million $H tokens through three breach vectors. The protocol's bridge infrastructure remains partially compromised as of June 15, 2026, with the attacker retaining ProxyAdmin control of the BSC token contract. No smart contract vulnerability was identified; the exploit exploited operational security failures rather than code flaws. The identity verification infrastructure built on palm biometrics, zero-knowledge proofs, decentralized identifiers, verifiable credentials, validator-operated verification, and on-chain Verification Oracle remains subject to failure risk in any of those components independent of the key management incident.
(Source: The Defiant Post-Mortem, Protocol Overview, Whitepaper, Credentials Verification Service)
The fixed-supply ERC-20 tokenomics model carries meaningful allocations to team (19%), investors (10%), treasury (12%), ecosystem funding (24%), and identity verification rewards (18%), making vesting cliffs, unlock timing, and incentive distribution important drivers of tokenholder outcomes. The next scheduled unlock is June 25, 2026, releasing tokens to Early Contributors. The unauthorized minting of approximately 300,000,000 $H on BNB Smart Chain during the June 2026 exploit has introduced supply uncertainty; whether those tokens will be burned, migrated, or otherwise addressed has not been disclosed. Reduced participation by validators, users, developers, or partner ecosystems could weaken the token's utility and network effects. The staking program references future validator and verification-service fees as a revenue source, and those fees remain unearned and dependent on adoption. Tokenomist
(Source: H Token, Tokenomist, CryptoTimes Post-Mortem, Fairdrop Launch, Staking Program)
This Token Transparency Filing is provided for general informational purposes only and does not verify or warrant the accuracy of individual answers.
