Upbit Cancels HEMI Token Launch Amid Major Token Theft

The South Korean cryptocurrency exchange Upbit had a chaotic Tuesday after it discovered a major token theft tied to an exploit of its smart contract. The HEMI token, which was set to launch on September 8, was canceled just 18 minutes before its planned opening due to the security vulnerability.

An attacker exploited a reentrancy flaw in a modified MerkleBox contract to drain approximately 124.5 million unclaimed HEMI tokens, using a two-million-HEMI flash loan and 63 recursive calls.

The stolen tokens were converted into around 158,200 USDT and 84,900 USDC, with the funds later swapped mostly into Ether across six blockchains, including Ethereum, Arbitrum, BNB Chain, Optimism, Avalanche, and Polygon.