At 15:00:42 UTC on 28 October 2026 an attacker took 12,773,243.03 eHMND from 436 accounts on Humanode, including the ChainPort vault that held eHMND. Humanode’s incident note says the loss was limited to specific accounts on its Ethereum-style environment that already had approvals, and to that vault. Native HMND, the coin on the other side of the same network, was not reachable through this flaw. The project says the hole is closed, that the bad approval on the vault is resolved, and that every owner will be reimbursed in full in the eHMND they lost. A dollar value for those owners is not in the note. This page will not describe how an existing approval was spent.
Humanode is a blockchain with two balances that share a name and do not share a pocket. The project describes the native side as proof of biometric uniqueness: a check that a validator is a living person, and that the same person is not quietly running many nodes. It says the biometric sample is discarded after the proof. The coin on that side is HMND. Beside it, the network runs an environment that looks like Ethereum to a wallet and to a contract. The coin there is eHMND. Contracts see it through an interface the project calls WeHMND. A user can swap between the native account and the contract account. They are the same network. They were not the same balance on 28 October. Ethereum without the jargon is the familiar shape of the contract side. It is not this chain.
What happened
Humanode deployed a fix at 15:40:48 UTC, 40 minutes and 6 seconds after the attack, by activating runtime spec 134 at block 20,446,186. The chain kept producing blocks. This was not a halt. The project says the call paths that were used now fail, and that an ordinary transfer of the native-side currency still succeeds. It counted the loss by comparing each account one block before the attack with the attack block, 20,445,791, because a single contract-creation transaction in that block did the damage, and because some event logs labelled the movement as a different token. An explorer that shows a strange ticker is not a reason to ignore a balance that actually changed. The team’s number is the balance comparison: 12,773,243.03 eHMND.
Of the 436 accounts, 281 were left at zero eHMND. Where the path was an existing approval, the amount taken stopped at the smaller of the balance and the approval. Most of the accounts sat on an allowance path through Impossible Swap. The five largest were accounts at TheHub. Humanode says TheHub uses 1inch limit-order code in TheHub’s own deployment, and that this incident does not establish a compromise of a deployment 1inch operates. What is 1inch (1INCH)? is that other product. Do not collapse them.
The ChainPort vault is inside the same total, not a second theft. Humanode says the missing vault balance is a shortfall in the Humanode-side backing of ChainPort’s wrapped token on other chains. A wrapped token is a claim on a pile somewhere else. If the pile is smaller, the claim is ahead of the coins. See A bridge is extra software, not a tunnel. The people who held eHMND on Humanode, and the people who held the wrapped version on another network, are not automatically the same creditors.
The attacker sold 12,734,327.11 eHMND into the Impossible Swap pool against USDC and received 18,804.19 USDC. Humanode’s own quote for that pool moved from about 0.002617 USDC per eHMND to about 0.000837, a fall of about 68 percent. The project is explicit that the USDC figure is what the sale cleared, not the value of what the 436 owners lost. Paying those owners back in eHMND, and restoring and rebalancing the pool, are two promises. About 38,915.92 eHMND separates the amount taken from the amount sold. Humanode says it has not established where that remainder went.
The note says public transactions show proceeds moving through ChainPort, Ethereum, LI.FI, and Hyperliquid. A later movement is consistent with a withdrawal toward Monero. Humanode has not confirmed that destination, and it has not identified the attacker. It also has not identified the spender on one path that touched 30 accounts, the precise ChainPort interaction, or a reproducible-build check of the runtime it deployed. Those are the open lines in the company’s own list.
The incident note is headed 28 October and timestamped 20:21 UTC. The blog’s publication date reads 29 October, which is what a clock east of UTC does with an evening post. The freeze Humanode announced — its exchange, its bridges, and its liquidity-provider staking — runs 72 hours from that publication timestamp. It is a freeze of those services. It is not a statement that native HMND transfers stopped. Reimbursement instructions, timing, and the pool restoration were still to be announced on Humanode’s own channels. A form that arrives any other way is not the reimbursement.
Why it matters
If you held eHMND in an account that had already approved WeHMND to an application, you are in the set they reconciled, or you are adjacent to it. An approval signed earlier was enough. The owners did not have to sign again during the attack. That is the company’s finding, and it is the useful one. See A wallet signature is not a handshake. An old approval is still permission until it is gone. This page will not walk through how that permission was exercised.
If you held native HMND outside the contract environment, Humanode says this flaw could not reach it. If you held only the wrapped token on another chain, your question is the vault, not the 436 accounts. If you held neither, this is someone else’s coin on someone else’s chain. The 68 percent move in one pool is a quote inside a sale. It is not a price target, and it is not a reason to trade eHMND or HMND.
The repayment is a project promise denominated in eHMND. The chain cannot mint the missing coins into the past. The same week, zkLink stopped its network after a bridge incident and did not publish a repayment figure at all. Initia halted and left the question of who was short still open. Humanode kept producing blocks, froze three services, and named a full eHMND repayment that has not yet been paid.
What happens next
Instructions for the reimbursement, on blog.humanode.io or the project’s own accounts. A restored pool, which Humanode separated from the payments to owners. Whatever the 72-hour review adds to the four open items already listed. A build comparison the project said it still wants. Watch those channels. See A practical checklist for keeping crypto safer before you connect a wallet to a page that says the refund is ready.
Not a recommendation to buy, sell, bridge, or hold HMND or eHMND. Not a finding that 1inch, Impossible Swap, or ChainPort each had a separate bug. Humanode’s account is that the flaw was in its own contract environment, and that those names were the paths.
