Hemi lost 124.5M unclaimed HEMI to a claim contract bug, says its post-mortem

What happened

Hemi distributed HEMI to early users through its Genesis Drop, using a claim contract called MerkleBox. On 7 September 2026 an attacker emptied about 124.5 million HEMI from it, all tokens that nobody had claimed yet.

Hemi's post-mortem, published the next day, says the contract updated its balances too late. That gap let the attacker claim many times inside a single transaction.

What is confirmed

Everything below is from Hemi's post-mortem unless marked otherwise. Times are UTC.

Timeline

• 7 September, 03:35. The attacker deploys three contracts.
• 7 September, 03:36. One transaction does the drain, 84 seconds after the setup.
• 7 September, 03:44 to 03:56. The proceeds leave Hemi through LayerZero.
• 7 September, 05:42. Hemi receives an alert from Hypernative.
• 7 September, 06:20. The root cause is identified.
• 7 September, 07:57. Hemi contacts SEAL 911.
• 8 September. Post-mortem published.

Amounts

• About 124.5 million HEMI were taken. They included unclaimed Genesis Drop tokens and tokens left from an earlier misconfigured reward distribution.
• The attacker sold them on Hemi DEXes for about $255,000 in stablecoins.
• Hemi says the pools were too thin to absorb the sale. The dollar figure does not reflect the full value of the tokens.
• The stablecoins were bridged to other networks. Most became ETH on Ethereum.
• Hemi says no stolen HEMI remains under the attacker's control.

Scope

• Hemi says the problem is isolated to the Genesis Drop claim contract.
• HEMI, veHEMI, the hVM, native tunnels and third-party bridges are not affected, according to Hemi.
• The contract cannot be paused or patched. Its balance is now zero.

Independent reading

• Blockchain AI News read the contract state. Its internal ledger still records 124,506,337.76 HEMI across claim groups, while the token contract shows zero. The ledger total matches Hemi's figure.
• OAK and DefiEdge describe the same mechanism as the post-mortem.

How the bug worked

A plain-words version follows. No code.

MerkleBox lets anyone create a claim group. A group has a list of who may claim what. All groups draw on one shared pool of HEMI. The contract keeps a per-group balance of what is left.

The Genesis Drop version was modified. When someone claimed, the contract created a locked position by calling a "lockup" contract. That contract was chosen by whoever created the claim group.

The order of steps was the problem:

Claim starts
  -> contract calls the lockup contract   (attacker's code runs here)
  -> contract updates the remaining balance (too late)

The attacker made a group where their own contract was both the claimant and the lockup contract. When the claim called out to it, it called the claim again. Each time, the balance still looked unspent.

A flash loan of 2 million HEMI funded the group. It was repaid in the same transaction. A second group collected the remainder.

Hemi names two causes: balances were updated after the external call, and anyone could set a custom lockup contract.

What is not known

• Who the attacker is. Hemi says the investigation is ongoing.
• Whether any funds will be recovered.
• Whether a reentrancy guard was missing or only inconsistently applied. OAK notes the post-mortem does not say.
• Whether other deployments reuse the same modified contract.
• Whether the remaining ETH has moved since the post-mortem.

Where sources disagree

There is no major conflict. Points to note:

• Token count and dollar value. 124.5 million HEMI is the amount taken. About $255,000 is what the attacker received. Hemi says the second figure understates the allocations' value.
• "Drained" versus the ledger. The token contract shows zero. The claim contract's own ledger still shows the old totals, because the attack bypassed the books.
• Unclaimed. Hemi says the tokens were unlikely to be claimed. ThreatWire cannot check that.

Lessons for builders

• Update state before external calls. Write the new balance first, then call out.
• Use a reentrancy guard on every function that moves value.
• Do not let users pick code your contract calls. A caller-chosen contract is attacker code.
• Isolate shared pools. Per-group accounting did not stop one group from spending the whole pool.
• Retire old contracts. Move or burn leftover funds from legacy distributions.
• Plan for immutability. A contract that cannot be paused needs extra care before launch.
• Alert fast. Detection came about two hours after the drain.

What users should do

• Hemi says HEMI and veHEMI were not affected. No action is needed for them.
• Follow Hemi's official channels for updates.
• Ignore unofficial messages that offer a "claim" or "refund" through unknown links.

Sources: Hemi's post-mortem, with Blockchain AI News, OAK and DefiEdge. ThreatWire has not verified the on-chain figures.