Jun 8, 2026
2 new drains.
New
-
High✓Contained
Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys
Attackers who compromised Injective Labs' GitHub repository published @injectivelabs/sdk-ts 1.20.21 to npm, along with 17 related @injectivelabs packages pinned to it. The malicious build hooked the fromMnemonic and fromHex functions and sent seed phrases and private keys to an Injective-looking endpoint whenever an app used them. It was downloaded about 310 times before being deprecated; no thefts had been reported. Any key or seed that passed through 1.20.21 should be treated as stolen; the clean version is 1.20.23.
npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages·Multiple EVM chains·Since Jun 8, 2026·
-
Critical◐Partly contained
Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys
On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools.
Humanity Protocol (H token) bridges and treasury·Ethereum, BNB Chain·$36M stolen·Since Jun 8, 2026·