June crypto losses show keys, not code, drove the biggest damage

At a glance

What this is: June 2026 crypto losses were dominated by key and credential compromise, with one targeted social-engineering operation accounting for the largest single loss.

Why it matters: Identity, key, and access governance now determine blast radius in crypto operations, so IAM, secrets, and privileged workflow controls matter as much as code review.

Context

June’s loss profile shows a governance gap, not just a code-quality problem. In crypto systems, private keys, credentialed access, and admin pathways often sit closer to value than the smart contract itself, so compromise of the control plane can be more damaging than a logic flaw in the asset contract.

The article also shows a broader NHI pattern: machine-held credentials, signing material, build tokens, and delegated access become the real security boundary once operations move through automation, supply chains, and remote administration. When those identities are weakly governed, the attack surface is operational as much as technical.

Key questions

Q: What breaks when crypto keys are compromised instead of code being exploited?

A: When keys are compromised, the attacker inherits legitimate authority and can often mint, upgrade, or transfer assets without breaking the contract itself. The failure is not just technical vulnerability but over-concentrated trust in a signing or admin identity. That is why authority scope, key custody, and revocation speed matter so much in crypto operations.

Q: Why do social-engineering attacks against crypto teams cause such large losses?

A: They work because a trusted human workflow can hand malware a path to the keys that control contracts and admin functions. Once an attacker reaches those credentials or signing paths, the blast radius expands from one compromised workstation to the protocol itself. The loss is driven by privileged authority, not by the lure alone.

Q: What are the signs that release and publishing identities are being abused?

A: Look for package releases, token requests, or build actions that succeed with credentials not normally associated with the repository or release lane. Unexpected OIDC token use, orphaned commits, and provenance that looks valid but came from an untrusted workflow are strong warning signals. Those conditions suggest the publishing identity, not just the artifact, is under attack.

Q: Should teams prioritise key governance over contract audits after these losses?

A: They should do both, but the priority order has changed. Contract audits reduce logic risk, yet June’s losses show that compromised keys and administrative workflows can overwhelm good code. Teams should first narrow privileged authority, then align audits, signing controls, and incident response around the identities that can move value.

Technical breakdown

Why key compromise outperforms code exploits in crypto

Crypto losses often start where authority concentrates, not where code executes. A private key, admin wallet, or proxy controller can rewrite contract state, mint assets, or redirect funds without touching the underlying application logic. That makes key compromise a direct path to irreversible impact. In practice, the contract may be sound while the governance around who can sign, upgrade, or approve changes is not. The control problem is therefore identity-bound authority, not only software correctness.

Practical implication: treat signing authority and upgrade control as primary assets, not just the contract they control.

How social engineering reaches keys behind protocol control

The Humanity Protocol case shows how a convincing lure can move from human interaction to privileged system access. Attackers used a malicious file disguised as an ordinary update request, delivered remote-access malware, and then reached the private keys behind the $H token. Once that authority was obtained, the attacker could upgrade the token contract and seize proxy administration. This is a classic identity-to-impact chain: initial trust exploitation, credentialed foothold, then privileged action.

Practical implication: protect token holders, admins, and operations staff with layered controls on update requests, execution paths, and signing workflows.

Why supply-chain and build identities now belong in the threat model

The month also shows that build pipelines and package publishing are part of the trust boundary. In the npm incident, malicious releases were able to look legitimate because the workflow requested a GitHub OIDC token and published with valid SLSA provenance attestations. That means provenance alone is not enough if the publishing identity or build context is compromised. This is where NHI governance matters: ephemeral tokens, CI identities, and delegated publishing rights can be abused as effectively as static secrets.

Practical implication: govern CI and package-publishing identities with the same scrutiny as human admin accounts.

Threat narrative

Attacker objective: The attacker’s objective was to obtain protocol-level signing and upgrade authority so they could mint, move, and drain assets under legitimate control paths.

1. Entry began with social engineering against the target team, using a malicious file disguised as a routine token-lockup schedule update.
2. Credential access followed when remote-access malware reached the private keys behind the $H token and the attacker seized privileged control paths.
3. Escalation occurred through token upgrade authority and ProxyAdmin control, allowing the attacker to mint and move assets under protocol authority.
4. Impact was the draining of roughly $32M from Humanity Protocol and the broader June loss profile being dominated by key compromise.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Key governance, not contract correctness, is now the dominant loss driver in crypto operations. June’s figures show that the largest damage came from who could sign, upgrade, and approve actions, not from a single spectacular code defect. Once authority is embedded in keys and administrative workflows, compromise of those identities becomes a direct route to loss. The practitioner conclusion is that crypto security has to treat authority distribution as the first control surface.

Social engineering remains effective because it targets the human-to-key bridge. The Humanity Protocol case did not need a complex protocol flaw to succeed. It only needed one trusted workflow to hand malware a path toward private keys and proxy control. That is a governance failure at the boundary between human trust and machine authority, and it shows why privileged workflow review matters as much as smart contract review.

Cloud and software supply chains are now NHI problems as much as DevSecOps problems. The npm incident demonstrates that OIDC tokens, publishing identities, and provenance attestations can be made to look legitimate while the underlying trust chain is compromised. That is a named concept worth tracking: publishing identity abuse, where the release mechanism itself becomes the path to access. The practitioner conclusion is to govern release identities, not only release artifacts.

Bridge and protocol losses remain symptoms of weak authority boundaries, not isolated bugs. The month’s cross-chain and access-control incidents reinforce that systems fail when a narrow control, such as proof validation or admin delegation, is treated as sufficient protection. When authority is over-broad or poorly verified, attackers can convert one trusted action into disproportionate damage. The practitioner conclusion is to narrow control scope before value is at risk.

What this signals

Publishing identity abuse: release systems are now attack paths when tokens, OIDC flows, and signing authority can be hijacked inside a trusted pipeline. Practitioners should treat package publishing, CI, and admin signing as one governed identity surface rather than separate technical tasks.

The clearest programme signal from June is that asset protection has to start with authority design. If a single compromised key can mint, upgrade, or move value, then the security model is already too permissive for the value it protects.

For practitioners

• Protect signing keys as production crown jewels Separate hot operational keys from treasury and upgrade authority, apply hardware-backed storage where feasible, and require explicit approval paths for every privileged signing event.
• Harden update and token-lockup workflows Treat routine-looking operational requests as hostile until verified, especially files or messages that can trigger code execution, key access, or contract upgrades.
• Govern CI and publishing identities Inventory GitHub OIDC, package publishing tokens, and build-time credentials, then limit each identity to the narrowest repository and release path it truly needs.
• Review proxy-admin and upgrade authority Map every entity that can upgrade contracts, mint assets, or move funds, and remove dormant or duplicated administrative paths before they are needed.
• Test incident response for key compromise Run scenarios where a signing key, publishing token, or proxy controller is exposed and require containment steps that can be executed before further privileged actions complete.

Key takeaways

• June’s losses show that crypto attackers often win by taking authority, not by defeating code.
• The largest incident combined social engineering with key compromise, proving that human trust and machine privilege remain tightly linked.
• Teams that can narrow signing authority, publishing rights, and upgrade paths reduce the damage even when a control is bypassed.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Signing Authority: Signing authority is the permission to create a legally or operationally valid signature on behalf of an organisation. It should be granted, monitored, and revoked like any other privileged access. In practice, the control fails when authority is assumed to live in the tool instead of the identity behind it.
• Publishing Identity: The account, token, or credential set that authorises changes to a software package distribution channel. It is a privileged non-human identity because it can affect many downstream systems at once, so compromise of this identity can become an ecosystem-wide security event.
• Proxy Administration: Proxy administration is the control path that lets an operator direct or upgrade a contract through an intermediary contract. It is especially sensitive because compromise of the proxy controller can override normal application behaviour without altering the original code base.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to govern machine identities, secrets, and access paths with more discipline.