Humanity Protocol

1.1 Identity, product, and corporate perimeter

Humanity Protocol presents itself as an identity infrastructure project that uses palm recognition and zero-knowledge proofs to let users demonstrate identity-related attributes without broadly exposing personal data. Founder Terence Kwok described the product as a privacy-preserving biometric alternative for Web3; 2026 reporting says the company is broadening the earlier proof-of-personhood proposition into reusable verifiable credentials under the Proof-of-Trust label. That is a reported positioning change, not evidence that all earlier products have been replaced or that the credential network has achieved commercial adoption. The source record does not establish a current legal headquarters: one article calls the company Hong Kong-based, while its publisher's company profile lists a San Francisco address. Neither description alone resolves the operating entity or incorporation jurisdiction.[CO001, CO002, CO003, CO012, CO013]

1.2 Leadership, investors, and governance visibility

Terence Kwok is the only executive identified consistently in the retained source set: an August 2024 interview has him identify himself as founder and CEO, and 2026 coverage quotes him on the protocol's direction. Funding coverage names Kingsway Capital in the 2024 seed financing and Pantera Capital and Jump Crypto as co-leads of a January 2025 round. Humanity's early materials also describe Animoca Brands and Polygon Labs as launch collaborators; this does not establish current contractual status, equity ownership, board seats, or control rights. A reported June 2026 compromise of a Humanity Foundation member's private keys makes the relationship between the company, foundation, privileged access, and token administration a material diligence question. The available sources do not provide a complete executive roster, board list, cap table, or governance-rights map.[CO003, CO004, CO007, CO008, CO014, CO016]

1.3 Funding, scale, and financial disclosure

Public reporting describes a roughly $30 million 2024 seed round led by Kingsway Capital and a separate $20 million January 2025 round co-led by Pantera Capital and Jump Crypto. The latter was reported at a $1.1 billion fully diluted valuation; that historical token-related valuation is not a current equity valuation, and the two round amounts should not be presented as audited cumulative proceeds or available cash. Biometric Update reported that the company said it had issued more than eight million Human IDs by February 2026. Issued IDs are not equivalent to monthly active people, paying customers, retained users, or revenue. The assigned evidence does not establish current ARR, revenue, margins, customer count, headcount, debt, or total raised after reconciling all financing events.[CO006, CO007, CO008]

1.4 Milestones and execution risk

The public chronology runs from a palm-biometric Web3 debut and 2024 testnet through reported 2025 mainnet, ticketing, and Mastercard-related milestones, followed by the 2026 Proof-of-Trust repositioning. Those announcements show product activity and intended integrations, but the source set does not establish contract depth, customer conversion, or recurring economics. In June 2026, Humanity disclosed a security incident involving private keys associated with a Humanity Foundation member; Wealthsimple's updated asset statement records the incident and subsequent migration plan. CryptoTimes also relays ZachXBT's public allegation that the incident was “possibly staged”; that is a contested allegation, not a verified finding. Recovery progress, independent post-incident controls testing, and the status of privileged access remain open diligence items.[CO004, CO005, CO010, CO011, CO014, CO015, CO016]

2.1 Define the market before sizing it

Mordor Intelligence defines identity verification as tools and services that confirm a person or business during onboarding and ongoing access, using document checks, biometric matching, and database validations across digital and physical channels. That is the defensible outer market boundary in the assigned evidence. General identity platforms, access management, fraud software, wallet infrastructure, and biometric hardware should not be added unless a paid verification workflow and its spend are isolated. Humanity Protocol describes a narrower palm-based proof-of-humanity anchor with selective credentials; that positioning can overlap with verification but does not make every digital identity deployment addressable. Public identity standards and wallet functions establish adjacent scope, not incremental company revenue.[CM001, CM002, CM009]

2.2 One broad estimate is context, not a Humanity TAM

Mordor's only retained dollar estimate is USD 15.78 billion for 2026, with a USD 26.8 billion forecast for 2031 and an 11.18% CAGR over 2026-2031; it identifies its method as proprietary. Its 2025 biometric share is not palm-specific, while its enterprise and financial-services shares describe the whole identity-verification category. The World Economic Forum's legal-ID count and FATF's 2020 unbanked-adult count are population lenses, not spend, paying buyers, or current serviceable accounts. No retained source bridges these broad measures to Humanity's proof-of-humanity or reusable-credential product. The pyramid is an unscaled boundary schematic: its layers overlap and do not support a calculated TAM, SAM, or SOM.[CM004, CM005, CM006, CM007, CM008]

2.3 Buyer, user, and payer differ by workflow

Potential buyers have distinct jobs and budget lines. Financial institutions assess identity for customer due diligence; public-sector programs specify proofing, authentication, federation, and wallet functions; online platforms may seek human or account-integrity checks. Mordor's category estimates point to financial services and large enterprises as important identity-verification segments, while LexisNexis reports fraud signals in ecommerce and gaming-related activity. Humanity's own page names banks, games, DAOs, and cities as credential use cases, but this is company positioning rather than verified customer demand. The assigned sources do not disclose Humanity contracts, paid verification volumes, pricing, renewals, or budget owners; the segment map is therefore a diligence hypothesis, not a customer roster.[CM006, CM009, CM010, CM011, CM012, CM013]

2.4 Fraud creates a driver, while assurance and trust constrain adoption

LexisNexis Risk Solutions reports fraud and synthetic-identity trends from its own Digital Identity Network, and says agentic traffic rose 450% between January and December 2025; it also states there was no indication of malicious intent for that agent traffic. Those measures indicate a changing verification environment, not Humanity Protocol usage or total market demand. NIST and FATF guidance make assurance, governance, and reliability relevant to deployment, while the World Economic Forum warns that policy, regulation, and technology affect decentralized identity's social impact. A CoinMarketCap digest relays a scheduled H-token unlock, which is a supply-side token event, not evidence of identity-service revenue. Halborn's fetched page body contains only a newsletter prompt despite its hack-explainer title, so it supplies no technical findings about controls or adoption impact.[CM003, CM011, CM012, CM013, CM014, CM015, CM016]

3.1 Competitive set and evidence coverage

The assigned evidence identifies World ID as the closest biometric comparison: World uses Orb-based verification, while Humanity describes palm-based identity credentials. BrightID represents a different architecture, using a social graph rather than biometric enrollment. Biometric Update also names Civic and Rarimo as proof-of-personhood contenders, but the available article does not profile their products, scale, or commercial terms. Conventional KYC appears as a substitute with a different privacy and decentralization trade-off; the assigned sources do not document a specific provider, price, or customer workflow. This is a sourced sample of alternatives, not an exhaustive market census. Platform-level account controls, internal builds, and unnamed entrants have no comparable profile in the assigned pool. Humanity's reported ID totals are not directly comparable: sources use different periods and do not establish active-user or paying-customer counts. Biometric Update also reported a $30 million seed round at a $1 billion valuation in 2024; that historical financing report does not establish current cash or valuation.[CP001, CP003, CP004, CP005, CP006, CP007, CP009, CP016]

3.2 Product models and claimed differentiation

The clearest difference in the source set is the enrollment anchor: Humanity's materials describe palm biometrics, World ID describes Orb verification, and BrightID describes identity derived from social relationships. Their privacy and portability statements are issuer claims, not like-for-like independent tests. World says a verified proof is encrypted to the user's phone and deleted from the Orb; BrightID says its social graph does not record personally identifying information. Humanity promotes selective credential sharing and cross-service use, while the third-party mainnet announcement lists loyalty and other credentials. Neither those feature descriptions nor the interview establish comparative biometric accuracy, privacy outcomes, or regulatory acceptance. The map below scores only how specifically the assigned texts describe each feature and how many independent descriptions appear in this source set. It is not a product-quality, privacy, security, or performance ranking. The feature matrix preserves unknowns where the source pool does not support a comparison.[CP001, CP002, CP003, CP004, CP006, CP008, CP010, CP011, CP012]

3.3 Distribution, durability, and adverse evidence

Humanity's materials describe a portable identity layer, while World ID lists supported apps and developer resources and BrightID describes application-facing one-account verification. These are distribution signals, not proof of contracted channels or durable lock-in. No assigned source supplies comparable pricing, contract structures, customer conversion, retention, multi-homing, or switching-cost evidence. Claims of portability could enable use across services, but the evidence does not show that users or developers cannot substitute another identity method. Trust is a material competitive constraint. ProofHuman attributes a June 2026 private-key compromise affecting Foundation-member wallet access to reporting by CoinDesk; it distinguishes that incident from a disclosed failure of palm or zero-knowledge verification. Biometric Update likewise says there was no indication that the verification biometrics failed in the reported incident. This distinction limits the technical inference but does not resolve governance, key-management, or control redesign. The sources also do not provide independent biometric accuracy studies or a comparable account of current security controls.[CP010, CP011, CP012, CP013, CP014, CP015, CP016]

4.1 Product activity is visible; monetization is not

Humanity's current public description presents a privacy-preserving identity and credential network, with APIs for integrating identity services; earlier reporting described its palm-based Proof-of-Humanity launch. The company later framed the product as expanding from uniqueness checks toward broader trust credentials. These materials describe what the network is intended to do, not the number of paying customers or the revenue earned per verification. The company's 2025 post also described more than five million Human IDs on its testnet, a company-reported activity measure rather than paid users, revenue, or retention. No reviewed source supplies a fee schedule, contract value, billing basis, revenue recognition policy, or customer-level conversion data. Financial underwriting should therefore treat service monetization as unproven, not infer revenue from product availability or testnet registrations.[CI001, CI002, CI003, CI004, CI013]

4.2 H utility is described, while token value is not company revenue

Humanity's company materials describe H as supporting rewards, governance, and participation; Wealthsimple identifies staking and ecosystem participation as uses. Its page is marked updated September 22, 2026, while the H update section is dated June 19, making the token-supply snapshot date unclear. Those descriptions establish intended token functions, not fee capture, treasury proceeds, or recurring fiat revenue. External token snapshots report different circulating-supply figures and market values, and their timestamps and methodologies do not reconcile cleanly. The June 2026 incident was followed by a reported sharp token-price decline and allegations of unauthorized token activity. These are material indicators of market and operational risk, but they are not a measure of the company's accounting loss, cash burn, or remaining assets. Treat token-market metrics as volatile external observations, separate from company operating performance.[CI005, CI007, CI008, CI009, CI010, CI011, CI012]

4.3 Historical financing does not answer present capital adequacy

Verdict and Biometric Update reported a $20 million round at a $1.1 billion fully diluted valuation in January 2025. This is useful historical financing context, but neither the round nor its valuation establishes proceeds still on hand, current liabilities, or available runway. The assigned public materials do not provide company revenue, gross margin, service-delivery costs, CAC, payback, working capital, capex, burn, debt, or current cash. The distinction is decisive: a funding announcement is not a balance sheet, a token price is not revenue, and an incident's reported token-market impact is not accounting loss or cash burn. Until management provides current financial statements and operating metrics, neither unit economics nor financing dependency can be underwritten quantitatively.[CI006, CI013, CI014, CI015]

4.4 Underwriting remains blocked by private operating data

The public record supports a product and token ecosystem with reported testnet activity, a historical financing round, and a live secondary-market token; it does not demonstrate a repeatable paid workflow or cash-generative operating model. The five-million-Human-ID figure is company-claimed testnet activity, and should not be substituted for paying accounts or customers. Token supply and market-price snapshots also differ across the sources and dates reviewed. The appropriate financial conclusion is a material evidence gap rather than a forecast: request audited or management-prepared income statements, cash and debt schedules, fee and contract data, customer cohorts, and post-incident treasury reconciliation. Revenue quality, margin trajectory, capital intensity, and runway remain unverified pending that evidence.[CI004, CI006, CI012, CI013, CI014, CI015]

5.1 Product surface and user workflow

Biometric Update's launch coverage and Humanity's LayerZero announcement describe a palm-based proof-of-humanity model with zero-knowledge verification (CE001). A founder interview describes mobile palm capture, but does not establish independently tested enrollment performance (CE002). Later mainnet-release coverage describes a broader credential proposition: zkTLS proofs over existing Web2 records, with loyalty, financial, educational, and professional examples (CE004, CE005). These are product and launch claims, not independent deployment or outcome measurements. A product guide published by XT Exchange also presents Human ID and H-token functions, but does not independently validate implementation or adoption (CE014).[CE001, CE002, CE004, CE005, CE014]

5.2 Architecture and maturity

The available descriptions span biometric enrollment, privacy-preserving credential proofs, a Humanity mainnet, and a reported zkTLS capability. Biometric Update describes the early palm-and-ZK proposal, while Humanity's LayerZero post says zkProofers handle verifiable credentials and zero-knowledge presentations without directly accessing user information (CE001, CE013). The GitHub organization page lists mainnet and testnet chain IDs, a Developer API link, and 31 repositories, which establishes a visible developer surface but not its usage or code quality (CE007). A mainnet launch article says zkTLS moved to the foreground and palm scans became optional; that is a reported product-positioning change, not measured biometric performance (CE008). The 2024 launch coverage documents the earlier palm-and-ZK framing (CE009). The architecture figure is therefore a map of attributed product descriptions, not a verified system diagram.[CE001, CE007, CE008, CE009, CE013]

5.3 Integrations and differentiation

Humanity announced LayerZero Labs as a zkProofer and described a potential integration context spanning more than 95 dApps and 70 chains (CE006). The mainnet-release page also lists airline and hotel loyalty accounts and financial, educational, and professional credentials as use cases (CE005). These announcements suggest a strategy of combining a reusable human credential with proofs of selected attributes, rather than making the palm scan the only ongoing interaction. However, the assigned evidence does not identify an independently verified production deployment, usage denominator, contract, or measured benefit for the named integration examples (CE005, CE006, CE012). Do not interpret an announced partner, a listed dApp universe, or a credential example as evidence of active customer adoption.[CE005, CE006, CE012]

5.4 Trust, security, and operating evidence

The privacy proposition depends on biometric handling, proof generation, credential control, and network/key operations, but the assigned first-party product and developer pages provide no independent audit scope, biometric error rates, uptime or service-level results, or production-use denominators (CE012). Biometric Update's company profile lists a February 23, 2026 headline attributing a major token breach to a key-storage error and malware infection; the profile excerpt does not establish incident scope or any compromise of palm biometrics (CE011). A Crypto Briefing interview records the founder's description of biometric information being held across multiple network nodes and user-deletable; this remains a company statement, not an independent control assessment (CE015). This is a material diligence signal, not proof that the identity verification mechanism failed. Investors should request the incident postmortem, current key-management and privileged-access controls, independent security assessments, and evidence distinguishing reserved IDs from verified and active credentials.[CE011, CE012]

6.1 Named relationships show routes to market, not proven deployments

The strongest named commercial evidence is a November 2025 report that Humanity Protocol was teaming with Mastercard on Human ID-based financial-attribute verification. The article describes an initial U.S. availability plan and a lender credit-approval example, but does not quantify completed verifications, active lenders, conversion, or customer outcomes (CU006, CU007). A separate Biometric Update listing records Humanity Protocol's acquisition of Moongate for ticketing, credentialing, and access, while Gate Learn describes physical access scenarios; neither source identifies a live customer deployment or measured result (CU009, CU010). The available proof therefore supports named ecosystem relationships and proposed use cases, not a verified customer roster or production adoption. The journey exhibit keeps those evidence states separate from outcomes that remain undisclosed.[CU006, CU007, CU009, CU010, CU014]

6.2 Reported identity counts do not establish active or paying users

The plausible user groups span individuals registering Human IDs, developers or applications that consume identity credentials, financial-service providers seeking reusable eligibility proofs, and event or physical-access operators. Public material describes these segments unevenly: company material discusses developers and testnet registrations, while the Mastercard article describes a financial-services use case and Moongate points toward ticketing (CU001, CU006, CU009, CU016). The available counts use different labels and periods: a January 2025 interview reported 3.2 million digital IDs created over the prior four months; a company blog claimed over 5 million Human IDs after a testnet launch; and a profile repeats undated homepage figures of more than 8 million Human IDs and 25 global-brand integrations (CU001-CU005). These figures are not a consistent active-user series, and neither brand integrations nor created IDs reveal unique active users, paying accounts, or repeat usage.[CU001, CU002, CU003, CU004, CU005, CU016]

6.3 Retention, payer economics, and security-related customer effects remain open

None of the assigned sources supplies customer-level retention, renewal, repeat-use, contract-value, revenue, or concentration data; nor do they provide a named production deployment with a quantified outcome (CU014, CU015). These are material underwriting gaps: the reported identity counts cannot distinguish registrations from durable use, and the announced integration examples do not show whether a buyer pays for repeated verification. The Crypto Times reported a June 2026 exploit and quoted the project's statement that a Foundation member's private keys had been compromised; it also reported precautionary user guidance while investigation continued (CU012, CU013). The article includes contested allegations about the incident, which are not independently established here. The event makes customer trust and continued usage diligence relevant, but the assigned evidence does not quantify customer losses, churn, or service discontinuity.[CU012, CU013, CU014, CU015]

7.1 Security event and recovery

BSC News reported that the June 8, 2026 H-token exploit followed malware on a developer machine and exposure of seven private keys, including administrative and Safe-owner keys; its account says attackers used legitimate keys rather than exploiting a smart-contract defect (CR001, CR002, CR003). CoinAlert also described a token replacement and 1:1 recovery airdrop, while BSC News said migration required coordination with exchanges, bridge providers, and liquidity partners (CR004, CR005). The incident is direct evidence that operational key custody can defeat otherwise audited code. The pool does not establish that token migration completed or that post-incident access controls were independently tested. Until those controls are evidenced, treat any privileged upgrade, bridge reopening, or recovery-contract administration as a high-impact residual exposure rather than assuming migration itself removed the access risk (CR014).[CR001, CR002, CR003, CR004, CR005, CR014]

7.2 Biometric privacy and regulatory exposure

Humanity Protocol's product page claims a palm scan can establish proof of humanity without storing sensitive data on a central server (CR006). That is a company representation, not independent evidence of collection boundaries, template reversibility, deletion, retention, or access controls. GDPR Article 9 treats biometric data used to uniquely identify a person as special-category data subject to a prohibition and specified exceptions; FTC guidance separately says businesses must honor privacy promises and maintain security appropriate to the data they hold (CR007, CR008, CR009). These sources define diligence questions, not a finding that Humanity Protocol is subject to or violates either regime. The applicable controller, jurisdictions, consent basis, processor chain, and breach-notification duties remain unverified; obtain the data-flow map and jurisdiction-by-jurisdiction legal assessment before treating the privacy architecture as a mitigant.[CR006, CR007, CR008, CR009]

7.3 Partner and commercial dependencies

Biometric Update described a Mastercard open-finance integration intended to let users prove financial credentials and link bank-account ownership through Human ID, with an initial U.S. rollout planned (CR010). The article reports an announced plan, not production deployment, customer conversion, or revenue. Separately, BSC News described the token migration as requiring coordination with centralized exchanges, bridge providers, and liquidity partners (CR005). These dependencies expose execution to counterparties and operational readiness outside the protocol's own code. The available record does not quantify partner concentration, contractual remedies, implementation ownership, or fallback paths. Request signed integration scope, launch acceptance criteria, active usage and service-level evidence, and migration confirmations from each relevant exchange and bridge before underwriting broad distribution or durable partner access.[CR005, CR010]

7.4 Token-market and financial visibility

BeInCrypto reported a January 2025 $20 million financing at a $1.1 billion fully diluted valuation, led by Pantera Capital and Jump Crypto; this is a historical financing report, not current valuation, runway, or cash available (CR011). BingX Learn described a roughly 69.5% H-token increase over 24 hours in a 2025 market episode, followed by a pullback, illustrating historical market volatility rather than current trading conditions (CR012). Humanity's own 2025 blog still described palm-scan verification as an upcoming rollout phase, which should not be read as evidence of present deployment (CR013). Current treasury composition, token unlocks, operating runway, and customer revenue are not established here. The investment case should remain gated on current cash and token-liability disclosures, independently verified recovery completion, and measurable evidence that integrations progressed from announcement to sustained use.[CR011, CR012, CR013]

7.5 Exhibits

8.1 What the public price evidence does—and does not—value

Two distinct valuation objects must not be conflated. News reports place a January 2025 $20m financing at a $1.1bn fully diluted valuation, while an earlier 2024 report described a $30m seed round at a $1bn valuation (CV001, CV002). These are historical reported financing marks, not a current October 2026 share price or verified enterprise value. CryptoRank displayed H at $0.05213 in the prefetched page (CV004); Wealthsimple's September 22, 2026 update gave a 10bn total supply and approximately 2.62bn H in circulation (CV005). Multiplying those inputs yields an estimated token FDV of about $521m and circulating capitalization of about $137m (CV006). The calculations are token-market measures: they do not establish company revenue, equity value, treasury backing, or investor proceeds. The displayed quote is a page snapshot without an explicit observation time in its text, and the circulating count is approximate. Do not use the token figures as a substitute for a current financing term sheet, cap table, or revenue-based valuation. The separate Worldcoin product comparisons are not financial comparables: the retained articles provide no matched operating metrics or valuation multiples for Humanity Protocol (CV016).[CV001, CV002, CV004, CV005, CV006, CV012, CV016]

8.2 Thesis and anti-thesis

The upside case is a company-positioned identity product: Humanity's own materials describe palm-based proof of humanity and reusable credentials, and its 2025 blog presented $H as a way to participate in the ecosystem (CV007, CV008). The blog also reported more than five million Human IDs, but that is a company-reported scale indicator, not verified active users, paying customers, retention, or revenue (CV009). The valuation bridge therefore depends on converting claimed identity activity into durable demand and monetizable workflows; this source pool provides no unit economics with which to underwrite that bridge. The anti-thesis is unusually material: Wealthsimple reported that Humanity disclosed a June 9, 2026 private-key compromise and a June 16 full token migration with a 1:1 airdrop (CV010). Crypto Times separately reported that on-chain investigator ZachXBT disputed the account; those allegations remain allegations, not established findings (CV011). The incident and migration make independent evidence on recovery, controls, supply reconciliation, and post-incident usage central to any valuation.[CV007, CV008, CV009, CV010, CV011, CV013]

8.3 Price-sensitive decision and diligence

The recommendation is research-more, with high risk and an unknown valuation stance—not a buy or an assertion that the token is cheap. The reported private mark is stale and fully diluted, while the observed H token price and supply produce only token-capitalization estimates (CV001, CV006, CV012). No probability-weighted company-equity value, target return, or exit multiple is supportable without current audited financials, an updated capitalization and preference schedule, and evidence that users or counterparties pay for the product (CV014, CV015). Scenario values below are explicitly token-FDV sensitivities, not forecasts or company valuations. Before reconsidering the call, obtain current financing documents and the cap table; revenue, gross margin, cash flow and paid-customer/retention data; token treasury, unlock and migration reconciliation; and independent post-incident security-control evidence. A verified paid customer base and successful independent control review would improve the case; unresolved privileged-key weaknesses, further dilution, or no demonstrated monetization would break it.[CV001, CV006, CV012, CV013, CV014, CV015]

8.4 Exhibits