Investigator links Humanity Protocol and KelpDAO hacks to one attacker, revealing a shared theft route

On-chain investigator ZachXBT says fresh fund-flow analysis points to the same person or group behind the hacks of Humanity Protocol and KelpDAO. The trail, he wrote, shows stolen assets from both incidents converging into a single route about an hour earlier, according to Odaily’s report on June 27.

If that reading holds, it would tie together two high-profile thefts that hit very different corners of crypto infrastructure. Humanity Protocol was hacked on June 9, with about $32 million in assets taken. KelpDAO lost about $292 million in an infrastructure breach on April 18, when attackers targeted the LayerZero (ZRO) bridge.

The KelpDAO case drew immediate attention because of its size and the route it took through bridge infrastructure, which has become one of the most exposed parts of crypto plumbing. At the time, some industry participants floated the possibility that Lazarus, the North Korean hacking group, was behind the breach. That was never confirmed, but the scale of the loss made the incident a reference point for wider concerns about bridge security.

ZachXBT’s latest comments cut against earlier speculation that the Humanity Protocol hack may have involved an insider. He said the new transfer map offers evidence pointing instead to a common external perpetrator across both incidents. The analysis does not amount to a formal attribution, though. No official confirmation has tied the two attacks together.

For traders, the link matters because it keeps attention on security risk in infrastructure-heavy tokens and protocols, especially those connected to bridge activity. ZRO was already in focus after the April breach, and new claims that the same actor may have been involved in both cases could keep pressure on sentiment around bridge security more broadly.

What to watch now is whether Humanity Protocol, KelpDAO, or outside investigators publish a formal incident update that matches ZachXBT’s fund-trace findings. Any confirmation of a shared attacker would strengthen the case for a coordinated campaign, while a contrary forensic report would reopen the question of whether the two hacks were truly connected.