28 October 2026

Published Time: [20:21:00 UTC]

At 15:00:42 UTC on 28 October 2026, an attacker exploited a vulnerability in Humanode EVM and took 12,773,243.03 eHMND from 436 accounts, including the ChainPort eHMND vault. The impact was localized to specific EVM accounts with existing WeHMND approvals and the affected vault. Native-side HMND balances outside the EVM were not reachable through this flaw.

The incident has been contained and all identified security issues have been fixed, including the malicious approval affecting the ChainPort vault. The full investigation is ongoing.

All eHMND lost as a result of this incident will be reimbursed in full to its owners. The affected eHMND/USDC liquidity pool will be restored and rebalanced.

We are sorry for the losses and disruption this incident caused. Our focus now is on reimbursement, restoring the pool and completing the investigation.

Our response

We deployed the Humanode EVM fix at 15:40:48 UTC, 40 minutes and 6 seconds after the attack, by activating runtime spec 134 on mainnet at block 20,446,186. Read-only checks confirmed that the exploited call paths are blocked. The malicious approval affecting the ChainPort vault has also been resolved.

We identified the affected accounts and reconciled their losses by comparing balances one block before the attack with balances at the attack block. The findings are detailed below.

We are freezing Humanode’s DEX, bridges and LP staking for 72 hours from publication of this announcement to manage the imbalance and conduct further audit and investigation. The same freeze window applies across our blog and social channels.

Freeze begins: [20:21:00 UTC]

Freeze ends: [72 hours]

What happened

Humanode EVM’s custom precompiles expose native chain functions to smart contracts. The native-currency precompile provides the WeHMND interface used by contracts to interact with eHMND.

The stateful precompiles accepted DELEGATECALL and CALLCODE calls that could let attacker-controlled code act through another contract’s identity. The attacker exploited this behavior to spend existing WeHMND allowances and act on behalf of a contract that called into attacker-controlled code.

Affected owners did not need to sign a new transaction during the attack. Existing approvals were sufficient for the allowance-based paths. The vulnerability was in Humanode EVM. The integrations listed below identify the paths through which funds were taken; they do not establish separate vulnerabilities in each integration.

Some transaction events were attributed to the attacker’s contracts instead of the precompile. Consequently, explorers could display real eHMND movements as if they were transfers of an unrelated token. The impact assessment therefore uses account-state comparisons as well as event logs.

Confirmed impact

A single contract-creation transaction in block 20,445,791 caused the confirmed losses. Individual path amounts below are rounded to two decimal places; the total is shown at full precision.

Of the 436 affected accounts, 281 were left with a zero eHMND balance. In the allowance-based paths, the amount taken was capped by each account’s balance and approval.

Most affected accounts were in the Impossible Swap allowance path. The five TheHub accounts accounted for the largest amount taken. TheHub uses 1inch Limit Order Protocol code in its own deployment; the incident does not establish a compromise of a deployment operated by 1inch.

The ChainPort vault loss created a corresponding shortfall in the Humanode-side backing of ChainPort’s wrapped token on other chains. That loss is included in the total above.

How the incident unfolded

All times below are UTC on 28 October 2026 and refer to on-chain transactions or runtime activation. The record does not establish separate timestamps for detection or completion of verification.

The liquidity pool and the proceeds

The attacker sold 12,734,327.112784423364708580 eHMND into the Impossible Swap WeHMND/USDC pool and received 18,804.193103 USDC. The pool’s quoted spot price fell from approximately 0.002617 to 0.000837 USDC per eHMND, a decline of about 68%. The affected eHMND/USDC pool will be restored and rebalanced as part of recovery.

The 18,804.193103 USDC figure measures the proceeds of the attacker’s sale, not the full value of affected owners’ losses. Full reimbursement of the eHMND taken and restoration of the pool are separate commitments.

Public transactions establish the movement through ChainPort, Ethereum, LI.FI and Hyperliquid. A later movement of XMR1 is consistent with a withdrawal toward Monero, but that destination has not been confirmed. The attacker’s identity also remains unconfirmed.

Verification of the EVM fix

The deployed change rejects DELEGATECALL and CALLCODE for the four stateful custom precompiles covering bioauthentication, EVM account mapping, native currency and EVM-to-native swaps. Read-only checks compared pre-attack behavior with spec 134: the previously accepted delegated calls now revert, while an ordinary native-currency call still succeeds. The DELEGATECALL check reverts across all four affected precompiles.

The identified EVM vulnerability and malicious vault approval have been fixed. The full investigation and audit continue, including a reproducible-build comparison for the deployed runtime.

Recovery and the 72 hour freeze

The security fixes are complete. The 72-hour freeze of the DEX, bridges and LP staking provides time to address the pool imbalance and conduct further audit and investigation. These services remain subject to the freeze window stated above.

Every owner will be reimbursed in full for the eHMND they lost in this incident. The affected eHMND/USDC pool will be restored and rebalanced. Reimbursement instructions, timing and pool-restoration details will be announced through official Humanode channels.

What the investigation still needs to establish

• The spender responsible for the path affecting 30 accounts.
• The destination of approximately 38,915.92 eHMND separating the confirmed amount taken from the amount sold into the exit pool.
• The precise ChainPort interaction through which the vault was affected.
• The reproducible-build comparison for the deployed runtime and the remaining details of the attacker’s fund movements.

The public RPC does not provide transaction call tracing, which limits reconstruction of some internal movements even where balance changes are confirmed. We will publish further findings and recovery updates as the investigation progresses, distinguishing confirmed evidence from working explanations.

Public transaction reference

Attack block: 20,445,791

Attack transaction:

0x5ed6b9e5661b7ba5237a81244725272482044b0b572267d2f7f31874d68c4a82

This update draws on on-chain records, balance comparisons, verification checks and our completed remediation work. The full investigation remains ongoing