Skip to content
THREATWIRE

2026-09-07 · record inc_0003 · updated 2026-10-19

Hemi Genesis Drop: reentrancy in the MerkleBox claim contract

About 124.5 million unclaimed HEMI were drained from the Genesis Drop claim contract in one transaction and sold for about $255,000.

HemiHemiComponent: Genesis Drop MerkleBox claim contract

Event
Official statement
Root cause
Official statement
Loss
Official statement

Current status

Investigation ongoing.

Timeline

  1. 2026-09-07 03:36 UTCDrain transaction.
  2. 2026-09-07 05:42 UTCAlert received.
  3. 2026-09-08Post-mortem published.

Root cause

Per Hemi's post-mortem, the contract updated its per-group balance after calling a lockup contract chosen by the claim group creator, so claims could be repeated inside one transaction.

Basis: official post-mortem · verified by us against that source

Classes: Reentrancy

Impact: loss and recovery

Unclaimed Genesis Drop allocations and leftovers from an earlier misconfigured distribution. Hemi says other components were not affected.

Reported loss

$255K (124,500,000 HEMI)

USD basis: Hemi post-mortem: stablecoins received on sale. Dollar figure does not reflect the token value; pools were thin.

Recovered or returned

Unknown

No recovery reported.

Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.

Addresses and transactions

No addresses or transaction hashes have been verified for this record. We do not publish unverified hashes.

Public reproduction file

No public reproduction file is recorded for this incident.

Remediation and defensive indicators

  • Contract cannot be paused or patched; balance is zero. (reported)

Defensive lessons from the class

  • Update balances before making external calls.
  • Add reentrancy guards on functions that move value.

Sources

  • Official post-mortem

    Hemi: Genesis Drop exploit on September 7 2026 post-mortem

    Published 2026-09-08 · retrieved 2026-10-19

  • Independent analysis

    Blockchain AI News: Hemi MerkleBox ledger reading

    retrieved 2026-10-19

  • Independent analysis

    OAK: Hemi Genesis Drop reentrancy unclaimed drain

    retrieved 2026-10-19

  • Media report

    DefiEdge: Hemi confirms claim contract bug

    retrieved 2026-10-19

Similar incidents

Read the full written analysis

Method, uncertainty and corrections

Still unknown

  • Attacker identity
  • Whether any funds will be recovered

Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.

No corrections recorded since publication.