Upbit Cancels HEMI Listing Amid Token Theft Exploit

South Korean exchange Upbit canceled the listing of HEMI after discovering a token theft linked to a smart-contract exploit on September 7. The attacker stole approximately 124.5 million unclaimed HEMI tokens and converted them into stablecoins, Ether, and other cryptocurrencies.

The exploit involved a reentrancy vulnerability in the Genesis Drop contract, which allowed the attacker to recursively execute the claim function 63 times. The stolen funds generated around $255,000 in stablecoins.

Cluster Protocol (CP) and Useless Coin began trading on Upbit as scheduled, with CP available in KRW, BTC, and USDT pairs. Deposits for CP are only supported through Base, while Useless Coin is listed against BTC and USDT.