ZachXBT: Humanity private key leak and abnormal surge in H token should be viewed separately

# ZachXBT: Humanity private key leak and abnormal surge in H token should be viewed separately

On June 9, according to related disclosures, on-chain investigator ZachXBT posted an update on Humanity’s roughly $31 million security incident, saying that after further analyzing fund flows, he currently tends to believe the project team was not involved in an “inside job” or a self-staged attack. According to him, the official explanation about the private key leak was broadly accurate, but before the token unlock, the price of H had been artificially pushed higher, and the hacker later took advantage of that market environment; therefore, the private key leak and the earlier abnormal price pumping should be regarded as two separate and independent events.

This reframing has changed the market’s understanding of the nature of the incident. Earlier discussions around Humanity focused on whether the team directly participated in the attack or used the security incident to conceal internal operations. ZachXBT’s latest remarks shift the emphasis from “whether it was self-theft” to “whether there were pre-unlock market structure problems.” He also questioned whether the team may have used suspicious market-making agreements and large over-the-counter trades to push up the price of H in order to reduce potential selling pressure before investor and early contributor tokens unlocked, or to create a smoother liquidity environment for later distribution.

Based on currently public information, these questions about market making and OTC arrangements remain investigative suspicions rather than confirmed conclusions. What is relatively clear at this stage is that ZachXBT no longer directly attributes the $31 million loss to team-led “self-theft,” but he remains skeptical about H token trading behavior leading up to the unlock window. The report also noted that the unlock timing related to investors and early contributors is around June 25, which means the issue extends beyond security alone into token liquidity management, price formation mechanisms, and potential conflicts in benefit allocation.

## Why It Matters

This matters not only because it involves a relatively large security loss, but also because it separates two risks that are often conflated: first, direct asset losses caused by poor private key management; and second, possible price management and liquidity arrangements ahead of token unlocks. If ZachXBT’s judgment is correct, what the market needs to reassess is not a single “hack” narrative, but whether a more complex chain of interests exists among the project team, market makers, OTC counterparties, and soon-to-unlock token supply.

For the secondary market, unusual upward price moves near an unlock are highly sensitive in themselves. If price support relies mainly on unconventional market making or off-exchange absorption rather than genuine buying demand, then once a security incident, unlock-related selling pressure, or counterparty liquidity withdrawal occurs at the same time, token price discovery can quickly become distorted. Current information remains incomplete, especially as key details such as market-making agreements, OTC counterparties, and the actual circulation arrangements before and after the unlock have not yet been disclosed.

## WEEX View

The core issue is no longer as simple as “was it the hacker or not,” but rather who was responsible for supporting the market ahead of the unlock, and who had the ability to smoothly rotate the soon-to-unlock token supply. If the private key leak is real and has no direct causal relationship with the price pump, then what the market needs to watch next is whether H’s liquidity came from natural trading or from apparent depth built jointly through market-maker inventory, OTC pre-distribution, and internal coordination. For frontline CEX operations, this directly affects listing risk controls, market-maker credit assessment, and abnormal trading surveillance: an order book that looks active does not mean real bid support exists; once market makers pull orders or OTC counterparties stop taking supply, depth can collapse instantly, and arbitrage boundaries can narrow sharply.

A more practical conflict of commercial interests is that pre-unlock “price stabilization” usually serves multiple parties: early investors want to lower the cost of selling, project teams want to maintain the valuation narrative, market makers want to earn from inventory management and spreads, and trading platforms care more about the appearance of liquidity and trading continuity. But these objectives are not aligned. If later disclosures show a high degree of coupling among unlockable token supply, market-making inventory, and off-exchange transactions, the market may reprice not only H itself, but also the credit discount applied to related projects on CEXs.

The three variables most worth watching next are: first, whether the project team will disclose more complete details about the private key leak, the affected addresses, and the remediation plan; second, whether supplementary on-chain or contractual evidence will emerge regarding the suspicious market-making agreements and large OTC trades; and third, whether abnormal patterns appear in the actual unlock size, on-chain transfer paths, and net exchange inflows around June 25. What will truly determine the next direction is not any single statement, but whether liquidity has real hard bid support, whether token supply is beginning to concentrate on centralized exchanges, and whether old money uses the unlock window to complete its rotation.