Humanode EVM: DELEGATECALL Into Stateful Precompiles Spent Existing Approvals

12,773,243.03 eHMND from 436 accounts, per Humanode. No USD figure stated by Humanode. The attacker's sale proceeds were 18,804.193103 USDC, per Humanode (not the victims' loss).

Root cause: Per Humanode: the stateful custom precompiles accepted DELEGATECALL and CALLCODE, so attacker-controlled code could act through another contract's identity. The attacker spent existing WeHMND allowances and acted on behalf of a contract that called into attacker code.

Timeline, as sourced: Attack 28 Oct 2026 15:00:42 UTC (block 20,445,791); fix (runtime spec 134) live 15:40:48 UTC (block 20,446,186); 72 h freeze of DEX, bridges and LP staking from 20:21 UTC. All per Humanode.

Humanode EVM, 28 Oct 2026, 15:00:42 UTC. Humanode's custom precompiles expose native chain functions to contracts; the native-currency precompile provides the WeHMND interface for eHMND.

Per Humanode (incident report (opens in a new tab)): the stateful precompiles accepted DELEGATECALL and CALLCODE, letting attacker-controlled code act through another contract's identity. The attacker spent existing WeHMND allowances and acted on behalf of a contract that called into attacker code. Owners signed nothing during the attack; existing approvals were enough. One contract-creation transaction in block 20,445,791, 0x5ed6b9e5661b7ba5237a81244725272482044b0b572267d2f7f31874d68c4a82, took 12,773,243.03 eHMND from 436 accounts, including the ChainPort eHMND vault, leaving a shortfall in the Humanode-side backing of ChainPort's wrapped token. Some events were attributed to attacker contracts, so explorers could show real eHMND moves as transfers of an unrelated token.

Per Humanode (report (opens in a new tab)): the attacker sold 12,734,327.11 eHMND into the Impossible Swap WeHMND/USDC pool for 18,804.193103 USDC, and the pool's spot price fell about 68%. Proceeds moved through ChainPort, Ethereum, LI.FI and Hyperliquid.

Response, per Humanode (report (opens in a new tab)): runtime spec 134 went live at 15:40:48 UTC (block 20,446,186), rejecting DELEGATECALL and CALLCODE on four stateful precompiles. DEX, bridges and LP staking are frozen for 72 hours from 20:21 UTC, 28 Oct. All eHMND lost will be reimbursed in full and the pool restored (X (opens in a new tab)).

Unknown, per Humanode: the spender behind one path affecting 30 accounts; the destination of ~38,915.92 eHMND between the amount taken and the amount sold; the exact ChainPort interaction; attacker identity. Not verified on-chain by NullMeridian (Humanode's public RPC lacks call tracing, per Humanode).