Humanode patches exploited EVM precompiles after eHMND is drained from 436 accounts
Humanode reports 12,773,243.03 eHMND taken from 436 accounts, including a ChainPort vault. Existing WeHMND approvals enabled theft without fresh signatures. Native-side balances were outside this flaw’s reach.
- Disclosed
- Oct 28, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Affected Humanode EVM approval holders and the ChainPort eHMND vault
- Humanode · EVM · crypto
- In the wild
- Yes
- Humanode confirms exploitation and says the identified flaws are fixed.
What happened
Stateful precompiles accepted DELEGATECALL/CALLCODE, enabling identity confusion. This does not establish separate integration vulnerabilities. The attacker’s roughly 18,804 USDC sale proceeds are not total victim losses. Investigation continues. The page header says October 29, but its explicitly dated statement is October 28; that earlier disclosure date is used here.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Humanode mainnet runtime | spec 134 | Activated |
Crime-scene timeline
Oct 28, 15:00:42 UTC
Attack transaction executes
Oct 28, 15:40:48 UTC
Mainnet activates the fix
Oct 28, 20:21 UTC
Statement announces a 72-hour DEX, bridge and LP-staking freeze
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Humanode incident response and recovery reportPrimaryConfirms losses and remediation; promises full eHMND reimbursement, not completed payments.