Humanode Patches EVM Precompile Flaw After Drain

On 28 October 2026, an attacker exploited a flaw in Humanode's EVM layer and took 12,773,243.03 eHMND from 436 accounts, according to the team's incident report. The flaw was not in a single application. It sat in the chain's own EVM implementation, in the custom precompiles that connect smart contracts to native chain functions. Humanode activated a runtime fix about 40 minutes later and says every affected owner will be reimbursed in full. What makes it notable is where the bug lived: below the contracts that users and auditors usually examine.

What happened#

Humanode runs an EVM alongside its native chain. EVM-side HMND is called eHMND. A native-currency precompile exposes it to contracts through an ERC-20-style interface called WeHMND. Precompiles are special addresses whose behaviour is built into the chain's runtime rather than deployed as contract code.

According to Humanode, four stateful precompiles accepted DELEGATECALL and CALLCODE. These are call types that execute code in the context of the calling contract. That let attacker-controlled code act under another contract's identity. In practice, it could spend WeHMND allowances that users had already granted, and act on behalf of contracts that called into attacker code. Affected owners did not sign anything during the attack; their existing approvals were enough. Humanode says the integrations through which funds were taken, including a DEX allowance path and the ChainPort bridge vault, were routes for the flaw rather than separate vulnerabilities.

A further detail matters for anyone reading block explorers. Humanode reports that some events were attributed to the attacker's contracts instead of the precompile. Explorers could therefore show real eHMND movements as transfers of an unrelated token. The team says it measured the losses by comparing account balances before and at the attack block, rather than relying on event logs alone.

What we verified#

Using Humanode's public EVM RPC (chain ID 5234), we confirmed the following:

• The transaction named by the team, 0x5ed6b9e5…8c4a82, is a successful contract-creation transaction from 0xea9d…ff9d. It was included in block 20,445,791 at 15:00:42 UTC and emitted 455 log entries.
• The runtime version changed from spec 132 to spec 134 at block 20,446,186, timestamped 15:40:48 UTC. This matches the team's account of the fix.
• An on-chain message on Arbitrum, sent to the same 0xea9d address, identifies its sender as "the Humanode team" and offers a whitehat bounty: the attacker may keep 20% if the remaining 80% is returned. Defimon Alerts relayed the message publicly.

We did not independently reconstruct the per-account losses. The 436-account figure, the 12,773,243.03 eHMND total and the swap proceeds are Humanode's numbers.

Amounts and open points#

Humanode says the attacker sold about 12.73 million eHMND into the eHMND/USDC pool and received 18,804.19 USDC. The pool's quoted price fell by about 68%. The team stresses that the USDC figure measures the attacker's sale proceeds, not the value of owners' losses. Of the 436 accounts, 281 were left with a zero eHMND balance. The funds moved through ChainPort, Ethereum, LI.FI and Hyperliquid. A later movement may point toward Monero, which the team has not confirmed.

The figures also changed during the response. The earlier on-chain message referred to "438 wallets" and "native HMND". The later report gives 436 accounts and says native-side HMND outside the EVM was not reachable through this flaw. We treat the later, more detailed report as the reference.

Still open, by Humanode's own account:

• the spender behind one path affecting 30 accounts;
• where about 38,915.92 eHMND went;
• the exact ChainPort interaction;
• a reproducible-build comparison of the deployed runtime.

The attacker's identity is unknown. Humanode has frozen its DEX, bridges and LP staking for 72 hours from 20:21 UTC on 28 October. Timing and instructions for reimbursement have not yet been published.

Our view#

Audits and approval hygiene usually focus on contracts. This incident shows that the execution environment underneath them can carry the same class of risk. A precompile that behaves differently from ordinary contract code is part of the security boundary of every application on the chain. Two practical points follow for users: old allowances remain live permissions, and explorer data during an incident may not reflect what actually moved.

Sources#

• Humanode, "Humanode incident response and recovery update", 28-29 Oct 2026: https://blog.humanode.io/humanode-incident-response-and-recovery-update/
• Humanode Docs, EVM precompiles: https://gitbook.humanode.io/docs/evm/precompiles
• Defimon Alerts, relay of the Humanode team's on-chain bounty message, X, 28 Oct 2026: https://x.com/DefimonAlerts/status/2115481028831625523
• On-chain bounty message on Arbitrum (Arbiscan): https://arbiscan.io/tx/0x8903024e1e030360229d6cfadb1db02b4faadb9b17f64db94dedebdf00b3fc42
• Humanode EVM public RPC used for our checks (chain ID 5234): https://explorer-rpc-http.mainnet.stages.humanode.io