Hemi's Empty Claim Contract Still Says It Holds 124.5 Million Tokens

Ask the HEMI token contract how much HEMI the Genesis Drop claim contract holds and the answer is zero. Ask the claim contract itself and it gives a different answer. Its per-group accounting still records 124,506,337.76 HEMI across its claim groups, in a field the source code describes as the "amount of token held currently."

Both numbers are correct, and the gap between them is the attack. On September 7 at 03:36:47 UTC, according to Hemi's post-mortem, an attacker drained "approximately 124.5 million" unclaimed HEMI from the MerkleBox contract behind Hemi's Genesis Drop. This desk read that contract's state on Hemi mainnet. The ledger total lines up with that figure, down to the roughly 506,337.76-HEMI tail the attacker's second pass collected. The attack emptied the pot without touching anyone's entry in the books.

A claim box anyone could configure

Hemi describes MerkleBox plainly. A funder deposits tokens with a Merkle root of addresses and amounts, which forms a "claim group". Recipients claim by proving they are on the list. "Any address can create a claim group, and every group draws on one HEMI balance held by the contract." The Genesis Drop deployment was a modified version: it added lockup options to claim() and called a lockup contract, set per claim group, to create a veHEMI position. Hemi says the modification "exists only in this deployment." The same deployment was then reused for later distributions, including the Spectra and DODO points drop.

According to the Hemi explorer, the contract was created on August 28, 2025 and its source verified the same day. That verified source shows the flaw Hemi describes. When a claim uses lockups, _createLockupFor approves the lockup contract and calls its createLockFor function. Only after that external call does it subtract the tokens from the group's balance. claim() marks the claim as spent on its very last line. No reentrancy guard appears anywhere in the file. The only check on the lockup contract is that its address contains code.

Eighty-four seconds of setup, one transaction

Hemi's account of the attack is precise. At 03:35:23 the attacker deployed three contracts: an orchestrator, a claim-group creator and a fake lockup contract. Eighty-four seconds later, one transaction did the rest. It flash-borrowed 2 million HEMI from a Sushiswap pool and opened a claim group funded with it, naming the fake lockup contract as both sole claimant and lockup contract. When MerkleBox called that contract to create a lock, the contract called claim() again, 63 times. A second group mopped up the last roughly 506,337.76 HEMI. The loan was repaid with its 0.05% fee.

The chain shows the same thing from the other side. The attacker's two groups, numbered 15 and 16, carry the memo "hemi-p8" and zero balances. Each has a withdrawal unlock time of exactly 30 days after the attack, the minimum the contract allows. Every nested claim re-read a group balance that had not been updated yet. The debits, when they finally ran, only ever hit the attacker's own groups. The legitimate groups' entries were never touched. The HEMI they describe is gone.

The attacker sold the HEMI into Hemi's own DEX pools for about $255,000 in stablecoins. By 03:56:23 the proceeds had been bridged through LayerZero to Ethereum, Arbitrum, BNB Chain, Optimism, Avalanche and Polygon, and most was later converted to ETH. The first alert, from Hypernative, came at 05:42, an hour and 46 minutes after the last bridge transfer. Hemi notes the pools were "too thin to absorb the size of the sale," so the dollar figure understates what the allocations were worth.

Related 46 Billion Synthetic Bitcoin Converted Into 4.39 Real Ones

Eleven months of unlocked balances

The post-mortem calls the drained tokens allocations that "remained unclaimed since becoming available around the initial launch of HEMI token, and were highly unlikely to be claimed." The contract's state adds a detail the post-mortem does not mention. Every claim group has an owner and a withdrawal unlock time, and after that time withdrawFunds lets the owner pull the group's remaining balance back out.

The largest entry, about 104.9 million HEMI, sits in a group labelled "test". Hemi's post-mortem says the contract's balance "also included additional tokens from a previously misconfigured reward distribution." The chain alone doesn't show whether group 9 is that distribution, and this desk is not treating it as established. What the chain does show is that nearly all the recorded balance had been withdrawable by its group owners since late September 2025.

Hemi has not said why the balances stayed. There are ordinary reasons to leave a claim window open indefinitely, and a late claimer who finds the door shut has a real grievance. But the result was that an immutable, permissionless contract held a nine-figure count of tokens for about a year. Any group creator could choose the lockup contract it called out to. Hemi's own post-mortem judged that balance unlikely ever to be claimed.

What the audit shelf holds

Hemi's public audit-reports repository contains reports for three components: the Bitcoin Tunnel, the HEMI token and veHEMI. None covers the Genesis Drop claim contract. That does not prove the modified MerkleBox was never reviewed, only that no review of it is published there. The post-mortem does not mention an audit either way.

The consequences reached beyond the contract. Per crypto.news, Upbit cancelled HEMI's planned market debut 18 minutes before its scheduled 9:30 p.m. Korea time launch on September 8, citing the exploit, and said it would strengthen pre-listing review. Hemi says the HEMI and veHEMI tokens, the hVM and its tunnels were not affected. The contract "cannot be paused or patched in place," and it now holds nothing. The post-mortem says the investigation into the attacker and possible recovery is ongoing. It does not address people who still had allocations to claim.