Hemi Genesis Drop Suffers Reentrancy Attack Resulting in Loss of Approximately 124.5 Million Tokens

Hemi released an analysis report on the Genesis Drop vulnerability attack that occurred on September 7. At 03:36:47 UTC on September 7, attackers exploited a vulnerability in Hemi's Genesis Drop MerkleBox smart contract, stealing approximately 124.5 million unclaimed tokens. The vulnerability stemmed from a reentrancy attack, where the contract processed the creation of token locks before updating account balances, allowing attackers to withdraw funds exceeding their configured limits. The attackers initiated the attack using 2 million tokens from the HEMI/USDT pool on Sushiswap as a flash loan, executing the attack atomically through orchestrated contracts and repaying the loan. The stolen tokens were subsequently liquidated on decentralized exchanges within the Hemi network, generating approximately $255,000 in stablecoins, which were cross-chained via LayerZero to networks such as Ethereum, Arbitrum, and BSC, mostly converting to Ethereum. The Hemi team received an alert at 05:42 UTC and identified the root cause in less than an hour. The affected contract is non-upgradable, currently has a zero balance, and poses no further risk. The rest of Hemi's infrastructure remains unaffected, and investigations into the attackers' identities and fund recovery efforts are ongoing.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.