A ten-year-old bug just resurfaced on a Bitcoin layer-2 network, and it barely made a dent. On September 7, 2026, an attacker drained 124.5 million HEMI tokens from a claim contract belonging to Hemi Network, the modular Bitcoin-Ethereum layer-2 project. The exploit relied on reentrancy, the same flaw that gutted The DAO in 2016 and helped define an entire era of Ethereum security failures. This time the payout was small: about $255,000. But the fallout was not. South Korean exchange Upbit yanked its planned HEMI listing days before launch, and Hemi’s own post-mortem became a case study in how immutable code can turn a minor bug into a permanent scar.
The story matters less for its dollar figure and more for what it says about smart contract security nine years after the industry supposedly learned this lesson. Reentrancy bugs are rare in 2026 audits, showing up in roughly 6-8% of high-severity findings according to aggregated audit-firm data, down from being the single most common finding class between 2018 and 2020. Yet Hemi’s Genesis Drop contract, built specifically to distribute tokens to early users, shipped with exactly this flaw and could not be patched once deployed. That combination, an old bug in new immutable code, is the real story here.
What Happened: Hemi’s Genesis Drop Exploit Timeline
The attack hit at 03:36:47 UTC on September 7, 2026, targeting a contract known internally as MerkleBox, which handled Hemi’s Genesis Drop token distribution. Hemi published a detailed post-mortem on September 8, and coverage spread across crypto outlets on September 9 and 10, according to Crypto Economy’s report on the disclosure.
The attacker did not touch Hemi’s core network, its native HEMI or veHEMI tokens, the Hemi Virtual Machine, or any bridging infrastructure. The damage was contained entirely to one claim contract holding unclaimed Genesis Drop allocations, tokens that had never actually reached user wallets. That containment is the one piece of good news in the whole episode, and Hemi leaned on it heavily in its public statements.
Within roughly a day of the exploit, the stolen tokens had already moved. The attacker liquidated the haul on decentralized exchanges inside the Hemi ecosystem, then bridged the proceeds across LayerZero to Ethereum, Arbitrum, and BNB Smart Chain, converting most of it into ETH along the way. That kind of rapid, multi-chain laundering has become standard practice for exploit proceeds in 2026, making after-the-fact recovery far harder than freezing funds on a single chain.
Inside the Bug: How the MerkleBox Reentrancy Flaw Worked
The MerkleBox contract let users configure custom claim groups, each with its own lockup logic and allocation cap. That flexibility became the opening. The contract’s claim function created a token lock first, then updated the internal accounting that was supposed to track how much a claims group had already withdrawn. Anyone who has read the Hemi post-mortem will recognize the pattern immediately: it is a textbook violation of the checks-effects-interactions rule that Ethereum developers are taught on day one.
By calling the claim function again before the first call finished updating state, the attacker could keep withdrawing against the same claims group long after its configured cap should have blocked further payouts. Each recursive call saw the same stale balance, because the contract had not yet recorded the previous withdrawal. Multiply that gap by enough repetitions and a contract meant to distribute a capped allocation starts paying out far beyond what governance ever approved.
OpenZeppelin’s ReentrancyGuard module exists specifically to block this pattern, and it has become close to a default import for production Ethereum contracts. Hemi’s Genesis Drop contract either omitted the guard on this particular function or applied it inconsistently across the claim logic, though the public post-mortem does not spell out exactly which. Either way, the fix that has been open-source and free for years was not in place where it mattered.
The Flash Loan That Powered 63 Recursive Calls
Pure reentrancy gets you a bigger balance, but it does not get you liquidity to work with. The attacker solved that with a flash loan of 2 million HEMI tokens borrowed from a SushiSwap pool, executed atomically through an orchestrator contract that repaid the loan within the same transaction. Flash loans have been part of the DeFi attacker toolkit since 2020, and by 2026 they remain the cheapest way to fund an exploit without risking any of your own capital.
Using that borrowed liquidity as a starting position, the attacker triggered the claim function 63 times in rapid succession within a single transaction bundle. Each pass drained a bit more of the unclaimed allocation sitting in the MerkleBox contract until the balance hit zero. The entire sequence, from flash loan to final withdrawal to loan repayment, completed atomically, meaning if any step had failed the whole transaction would have reverted and cost the attacker almost nothing to attempt.
That atomicity is precisely why reentrancy paired with flash loans remains dangerous even in a market that has gotten much better at catching these bugs before launch. The attacker faces effectively no financial risk testing an exploit, since a failed attempt simply reverts and gas fees are the only cost. Cheap, low-risk experimentation is how a niche bug class from 2016 keeps finding new contracts to break in 2026.
Why 124.5 Million Tokens Only Fetched $255,000
The headline token count sounds alarming, but the dollar figure tells a different story. The 124.5 million HEMI tokens drained were unclaimed allocations sitting in the Genesis Drop pool, tokens that had never entered circulating supply and were priced accordingly thin once the attacker tried to dump them. Selling that volume on Hemi’s own decentralized exchanges crashed the effective price the attacker received, and the total realized proceeds landed at roughly $255,000 in stablecoins and later ETH.
That gap between headline token count and realized value is a pattern worth remembering. Exploits involving pre-launch or unclaimed allocations routinely generate large-sounding token figures that convert into far smaller real losses, simply because there is not enough market depth to absorb a sudden sale of that size. Compare that to a hack draining already-circulating, liquid tokens from a mature protocol, where the dollar figure and the token figure tend to track much closer together.
For Hemi specifically, the practical loss is a wiped-out claim pool rather than a drained treasury. Users who had not yet claimed their Genesis Drop allocation are now out of luck on that specific contract, since Hemi confirmed the balance sits at zero and the contract cannot be topped up or reopened. The company has not detailed a compensation plan for affected claimants as of this writing.
Upbit Pulls the Plug: A Listing Canceled Before It Started
The most consequential fallout had nothing to do with the stolen $255,000. Upbit, South Korea’s largest cryptocurrency exchange by trading volume, had HEMI queued for a listing when the exploit news broke. Rather than proceed, Upbit canceled the listing outright, according to reporting from Crypto.news, replacing HEMI’s planned slot with two other tokens instead.
A canceled listing before launch carries a different weight than a delisting after years of trading. It signals that a major exchange’s risk team looked at a fresh security incident, even one confined to a single contract with a small dollar loss, and decided the reputational exposure was not worth it. The Cryptonomist’s coverage of the episode framed it as a cautionary tale for any project timing a major exchange listing close to a public code deployment, since a bug discovered at the wrong moment can cost a token its distribution channel entirely.
For a project the size of Hemi, exchange access is not a minor detail. Listings on top-tier venues drive liquidity, price discovery, and retail access all at once. Losing one, even temporarily, tends to matter more to a token’s near-term trajectory than a five- or six-figure exploit ever could.
Hemi’s Damage Control: What the Post-Mortem Says
Hemi’s public messaging after the exploit followed a now-familiar playbook: isolate the blast radius, confirm what was not touched, and commit to a fix. The team stated plainly that the exploited contract held a zero balance going forward and posed no additional risk, since there was nothing left in it to steal. It separately confirmed that core infrastructure, including bridges and the token contract itself, never came into contact with the vulnerable code path.
That framing is accurate as far as it goes, but it also understates the harder problem: the contract was immutable, meaning Hemi could not have patched it even if the team had caught the bug before an attacker did. Immutability is often sold as a security feature, since it prevents a malicious admin key from rewriting contract logic after the fact. Here it cut the other way, turning what might have been a fixable bug into a guaranteed loss the moment someone found it.
Hemi has not published a revised audit of its remaining contracts specific to this incident, nor has it named the audit firm, if any, that reviewed the Genesis Drop code before launch. That gap leaves an open question for the broader ecosystem: how many other immutable claim contracts, deployed for one-time token distributions and then forgotten, carry similar unpatched risk sitting dormant right now.
Ten Years After The DAO: Why Reentrancy Still Happens
Reentrancy is not a new discovery. On June 17, 2016, an attacker used the identical pattern, a fallback function calling back into a contract before its balance updated, to drain roughly 3.6 million ETH from The DAO, worth an estimated $50-60 million at the time. That single hack forced a contentious Ethereum hard fork and became the founding case study for an entire generation of smart contract security tooling.
The years since produced plenty of repeat offenders. Cream Finance lost more than $130 million across multiple 2021 incidents that included reentrancy alongside price-oracle manipulation. Fei Protocol’s Rari Capital integration lost around $80 million to a reentrancy flaw in its Fuse pool logic in 2022. Grim Finance, a smaller Fantom-based yield optimizer, lost roughly $30 million the same year to attackers who repeatedly deposited and withdrew before balances could catch up. Each incident produced the same post-mortem lesson, and each time the industry response was the same: adopt the checks-effects-interactions pattern, standardize on tools like OpenZeppelin’s ReentrancyGuard, and run static analyzers like Slither before shipping.
Those defenses worked, broadly. A September 2026 blockchain security summary noted that reentrancy attacks sat at historically low levels for the year, with zero reentrancy incidents reported in August 2026 across the wider market. Hemi’s September 7 exploit is the exception that proves that rule: rare enough to be notable, familiar enough that any competent audit should have caught it.
Hemi vs. 2026’s Biggest DeFi Exploits
Placed next to the year’s headline hacks, Hemi’s loss barely registers. The two largest 2026 DeFi incidents, KelpDAO’s LayerZero bridge exploit and the Drift Protocol breach on Solana, each cost more than a thousand times what Hemi lost, and neither involved a reentrancy bug at all. That divergence says something important: the biggest dollar losses in 2026 are coming from bridge misconfigurations and governance key compromises, not classic contract-logic bugs.
| Incident | Date (2026) | Amount Lost | Attack Vector | Recovery Status |
|---|---|---|---|---|
| Hemi Genesis Drop | Sept. 7 | ~$255,000 (124.5M HEMI) | Reentrancy in claim contract | None recovered |
| FutureSwap (Arbitrum) | Jan. 14 | ~$74,000 | Reentrancy | Not reported |
| Cronos Tectonic | Aug. 30 | ~$74-75M ($9.19M unrecovered) | Collateral price manipulation | ~92% restored via chain rollback |
| Drift Protocol (Solana) | Apr. 1 | ~$285-295M | Admin key compromise, oracle manipulation | Limited recovery reported |
| KelpDAO / LayerZero bridge | Apr. 18 | ~$292-293M | Forged cross-chain message | None recovered |
The pattern in that table is the real headline. Every nine-figure loss in 2026 traces back to trust assumptions breaking, a forged bridge message, a compromised admin key, a manipulated price oracle, rather than a raw coding mistake inside a single function. Reentrancy, once the dominant attack class, now shows up mostly in smaller, contained incidents like Hemi’s, where the blast radius is limited by design rather than by luck.
Reentrancy’s Shrinking Share of Smart Contract Bugs
Audit data backs up that shift. Aggregated findings across major audit firms show reentrancy has fallen from a top-one finding class in 2018-2020 to roughly sixth place by 2026, accounting for an estimated 6-8% of high-severity findings industry-wide. The bugs that remain tend to be subtler variants: cross-function or cross-contract reentrancy that slips past single-function guards, reentrancy through ERC-721 and ERC-1155 safe-transfer callbacks, and read-only reentrancy where a view function returns stale data mid-transaction.
| Bug Class | 2018-2020 Ranking | 2026 Ranking | Est. Share of 2026 High-Severity Findings |
|---|---|---|---|
| Reentrancy | Top 1 | Top 6 | 6-8% |
| Access control failures | Top 3 | Top 1-2 | Highest single category |
| Price oracle manipulation | Not tracked separately | Top 2-3 | Major share of 2026 dollar losses |
| Cross-chain message / bridge flaws | Not applicable | Top 1-2 by dollar loss | Drove 2026’s two largest hacks |
| Governance / admin key compromise | Emerging | Top 3 | Tied to Drift Protocol’s $285M+ loss |
Read together, the two tables tell a coherent story. Reentrancy bugs like Hemi’s are becoming rarer and, when they do surface, smaller in dollar terms because the tooling to catch them is mature and widely deployed. Meanwhile the attack surface has migrated toward the connective tissue between chains and the humans who hold admin keys, categories where a decade of Solidity-specific tooling offers far less protection.
The 2026 DeFi Hack Landscape: Bigger Numbers, Better Recovery
Zoom out from Hemi and the broader 2026 numbers are sobering even with reentrancy in decline. Immunefi’s mid-year ecosystem update counted 207 hack incidents costing roughly $972 million across the first half of 2026, the highest incident count on record for a six-month period. Global Ledger’s independent tally for the same window came in higher still, at 224 publicly disclosed hacks totaling $1.32 billion, a discrepancy that mostly reflects differing definitions of what counts as a reportable hack.
What stands out in Global Ledger’s research is concentration. Just three incidents, KelpDAO, Drift Protocol, and a breach affecting Trezor’s Value Wallet, accounted for $846.29 million, or roughly 63.9%, of all H1 2026 losses. The other 221 incidents, Hemi included, split the remaining third among themselves, mostly in amounts small enough that no single one moves the yearly total by much.
Recovery rates, meanwhile, have quietly improved. Global Ledger’s data shows funds were recovered in just 5 of 119 incidents during H1 2025, about 4.2% of cases, representing 4.6% of stolen value. By H1 2026, recovery occurred in 16 of 224 incidents, 7.1% of cases, and those recoveries represented 10.86% of total value stolen, a 136% jump in the share of dollars returned year over year. Hemi’s $255,000 has not been recovered as of this writing and falls into the roughly 90% majority of incidents where funds simply disappear.
Market Impact: What This Means for Hemi and Token Launches
For Hemi, the practical fallout splits into two separate problems that will play out on different timelines. The technical problem, a drained claim contract, is already resolved in the narrow sense that there is nothing left to steal from it. The reputational problem, an exchange pulling a listing over a security incident, is harder to undo and will likely shape how other major exchanges evaluate HEMI going forward, since Upbit’s decision now sits in the token’s public history as a reference point.
The episode also lands at a moment when the broader market is watching exploit response times as a proxy for project maturity. A protocol that can isolate damage to a single non-critical contract, publish a technical post-mortem within 24 hours, and confirm core infrastructure is untouched, as Hemi did, tends to fare better with users than one that stays silent for days. Hemi’s speed here likely limited further damage even as it could not undo Upbit’s decision.
There is a broader lesson here for any project timing a token generation event or exchange listing around a claims contract. Genesis-drop and airdrop-claim contracts are frequently rushed into production ahead of a launch date, audited under time pressure, and then left immutable and unmonitored once the claim window closes. That is exactly the profile of contract most likely to carry an undetected bug, and exactly the kind of contract exchanges are increasingly willing to treat as a red flag.
Competitive Comparison: How Other Chains Handle Claim Contracts
Hemi is far from alone in shipping a claims contract that later needed remediation. FutureSwap’s January 2026 reentrancy exploit on Arbitrum, at roughly $74,000, is nearly a mirror image of Hemi’s incident in both attack pattern and scale, suggesting these bugs cluster in a specific category of contract rather than a specific chain or team. Both incidents involved custom claim or distribution logic written for a one-time event, both were immutable once deployed, and both produced dollar losses in the tens to low hundreds of thousands rather than the tens of millions.
Compare that to how larger, more established protocols now handle token distribution. Many major 2026 launches have shifted toward upgradeable proxy patterns specifically for claim contracts, accepting the centralization tradeoff of an admin key in exchange for the ability to pause or patch a distribution mechanism if a bug surfaces mid-claim. Others have adopted a staged-release model, unlocking only a fraction of total claimable tokens at a time so that any single exploit caps out at a fraction of total exposure, similar in spirit to how Hemi’s contract, by holding only unclaimed allocations, limited the blast radius here.
The tradeoff is not free either way. Immutable contracts resist admin abuse but guarantee permanent losses when bugs slip through. Upgradeable ones can be patched but reintroduce exactly the kind of centralized control point that decentralized projects are built to avoid. Hemi’s incident does not settle that debate, but it adds a concrete data point on the cost side of the immutability argument.
Predictions: Where Smart Contract Security Goes From Here
- Claim and airdrop contracts get extra audit scrutiny. Expect audit firms to start treating one-time distribution contracts as a distinct, higher-risk category given how many 2026 reentrancy bugs, Hemi and FutureSwap included, trace back to exactly this contract type.
- Exchanges formalize pre-listing security checks. Upbit’s decision to cancel a listing over a contained, sub-$300,000 incident suggests other top-tier exchanges will start requiring a clean incident history in the weeks immediately before a listing goes live, not just a passed audit months earlier.
- Reentrancy stays rare but never hits zero. With flash loans remaining cheap and low-risk to test, expect occasional small reentrancy incidents to keep surfacing through 2027, concentrated in rushed or under-audited contracts rather than mature, battle-tested protocols.
- Bridge and oracle exploits keep dominating dollar losses. Given that KelpDAO and Drift Protocol together outweighed dozens of smaller incidents combined, expect 2027’s largest hacks to again come from cross-chain messaging and price-oracle manipulation rather than raw contract logic bugs.
- Recovery rates keep climbing slowly. The jump from 4.6% to 10.86% of stolen value recovered between H1 2025 and H1 2026 reflects improving chain-analysis and law-enforcement coordination. Expect that trend to continue incrementally rather than solve the recovery problem outright.
The Bigger Picture for Bitcoin Layer-2 Security
Hemi’s positioning as a Bitcoin-Ethereum hybrid layer-2 adds a layer of context worth noting. Projects building settlement or scaling infrastructure tied to Bitcoin have generally marketed themselves on inherited security from Bitcoin’s base layer, even when the actual vulnerable code lives entirely in Ethereum-style smart contracts running alongside it. This exploit is a reminder that a project’s association with Bitcoin’s SHA-256 security model does nothing to protect a Solidity-style claim contract sitting on top of it. The bug, the flash loan, and the fix all belong entirely to the smart contract world, regardless of which base chain a project settles to.
That distinction matters more as more Bitcoin layer-2 and sidechain projects launch token generation events in 2026 and 2027. Users evaluating these projects need to separate the security guarantees of the underlying settlement layer from the security of whatever custom smart contract code a project bolts on top for token distribution, staking, or bridging. Hemi’s core infrastructure held up fine. Its claim contract did not, and that gap is exactly where the risk lived.
Frequently Asked Questions
What is the Hemi Genesis Drop exploit?
It was a reentrancy attack on September 7, 2026, that drained 124.5 million unclaimed HEMI tokens from Hemi Network’s MerkleBox claim contract, netting the attacker roughly $255,000 after liquidation.
How did the attacker execute the exploit?
The attacker borrowed 2 million HEMI tokens via a flash loan from a SushiSwap pool, then recursively triggered the claim function 63 times in a single atomic transaction, exploiting a reentrancy flaw where token locks were created before balances updated.
Did the exploit affect Hemi’s core network or HEMI token holders broadly?
No. Hemi confirmed that its core network, the HEMI and veHEMI tokens, the Hemi Virtual Machine, and its bridging infrastructure were unaffected. The damage was contained to the single immutable claim contract.
Why did Upbit cancel its HEMI listing?
Upbit had a HEMI listing planned around the time the exploit became public and chose to cancel it rather than proceed, listing two other tokens in its place instead, according to reporting from Crypto.news.
Can the exploited contract be fixed or reopened?
No. The Genesis Drop contract is immutable, meaning it cannot be upgraded, paused, or patched. It now holds a zero balance and Hemi has stated it poses no further risk since there are no remaining funds to drain.
How does this compare to other 2026 crypto hacks?
It is small. The KelpDAO/LayerZero exploit and the Drift Protocol breach each cost more than $285 million in 2026, over a thousand times Hemi’s loss, and neither involved reentrancy. Hemi’s incident is closer in scale to January 2026’s $74,000 FutureSwap reentrancy exploit on Arbitrum.
Is reentrancy still a common smart contract vulnerability in 2026?
It is far less common than a decade ago. Aggregated audit data suggests reentrancy accounts for roughly 6-8% of high-severity findings in 2026, down from being the top finding class between 2018 and 2020, largely thanks to widespread adoption of guards like OpenZeppelin’s ReentrancyGuard and the checks-effects-interactions coding pattern.
Were any funds recovered from the Hemi exploit?
No recovery has been reported as of this writing. The stolen tokens were liquidated and bridged across multiple chains within roughly a day, which is consistent with the roughly 90% of 2026 crypto hacks where stolen funds are never returned.
