Upbit Canceled a Token Listing 18 Minutes Before Launch: Inside the Hemi Hack That Drained 124.5 Million Tokens

South Korea’s largest crypto exchange pulled a token listing just 18 minutes before trading was set to begin — after discovering a thief had already made off with 124.5 million tokens.

By Diego Rivera | September 9, 2026

The Hook: A Listing Canceled at the Last Minute

On the evening of September 8, Upbit — South Korea’s biggest cryptocurrency exchange — was scheduled to open trading for three altcoins: Cluster Protocol (CP), Hemi (HEMI), and Useless Coin (USELESS). At 9:12 p.m. Korea Standard Time, just 18 minutes before HEMI’s scheduled debut, Upbit updated its notice and canceled HEMI trading entirely. The reason: evidence that HEMI tokens had been stolen in a smart-contract exploit the day before.

The move is a rare glimpse into the high-stakes decisions exchanges make behind the scenes — and a reminder for altcoin buyers that a scheduled listing is never a guarantee until trading actually opens.

What Happened: Inside the Hemi Exploit

According to a post-mortem published by the Hemi project, an attacker exploited its legacy Genesis Drop claim contract at 03:36 UTC on September 7 — a rewards distribution contract, separate from the token itself. The attacker abused a reentrancy vulnerability in a modified MerkleBox contract. In simple terms, the contract created token lockups before updating the remaining claimable balance — like a vending machine that hands out a snack before registering that you paid, letting you hit the button over and over.

• 124.5 million unclaimed HEMI tokens were drained by the attacker, per Hemi’s post-mortem.
• A 2-million-HEMI flash loan was used, and the claim process was recursively executed 63 times before accounting caught up.
• ~80.15 million HEMI were sold for roughly 158,200 USDT, and another ~41.4 million HEMI for about 84,900 USDC — a total of roughly 255,000 USD in stablecoins.
• Funds were laundered across Ethereum, Arbitrum, BNB Chain, Optimism, Avalanche and Polygon, with most proceeds converted into Ether.

Hemi says the damage was contained: its core HEMI and veHEMI tokens, the Hemi Virtual Machine, native tunnels and third-party bridges were unaffected. The project identified the vulnerability about two hours and 44 minutes after the exploit, contacted partners, and referred the incident to the SEAL 911 security response service. It is tracing proceeds and working with law enforcement — but no reimbursement plan has been announced.

The Other Two Listings Went Ahead — With Training Wheels

While HEMI was scrapped, the other two listings proceeded as planned — and they show how carefully Upbit now handles new tokens. Cluster Protocol (CP), described by Upbit as artificial-intelligence infrastructure that connects models, data, GPU computing and AI agents through one interface with an on-chain payment system, began trading at 2:30 p.m. Korea time in KRW, BTC and USDT pairs — with deposits accepted only through Base. For roughly the first five minutes, purchases were restricted, sell orders priced at least 10% below the previous close were blocked, and only limit orders were allowed for the first two hours. These are guardrails designed to stop the wild opening-minute pumps and dumps that often greet small-cap listings.

Useless Coin (USELESS) opened at the originally planned 9:30 p.m. slot against BTC and USDT, with deposits and withdrawals supported only through Solana. True to its name, USELESS makes no pretense of technical utility — Upbit’s own notice describes it as a community-driven meme coin built around the satirical promise of no product and no roadmap. That a major exchange is listing a self-described joke token — while simultaneously canceling a “serious” infrastructure token over a hack — captures the strange moment the altcoin market is in.

Why This Matters for Altcoin Investors

For regular investors, there are two practical lessons. First, a listing announcement is not the same as a listing. Anyone who bought HEMI ahead of the expected Upbit debut — a classic “listing pump” trade — was left holding a token that just lost its biggest catalyst, with rival exchange Bithumb placing HEMI under an investment warning over the abnormal withdrawals. HEMI will now need a fresh review before any future Upbit launch.

Second, legacy contracts are a quiet risk. The exploit didn’t touch Hemi’s main network or bridge — it hit an old airdrop-claim mechanism. Older, less-audited contracts sitting at the edge of a project are often the softest target for attackers, and no amount of mainnet security fixes that.

The Verdict

Upbit’s 18th-hour cancellation looks like good risk management: the exchange reviewed the theft, decided trading could be distorted, and took the reputational hit of a public reversal rather than opening markets on compromised footing. It has also promised to strengthen its pre-listing review procedures. The episode lands as South Korean regulators continue scrutinizing exchange security — authorities have opened sanctions proceedings against Upbit operator Dunamu over a separate wallet breach reported in November 2025. For altcoin holders, the takeaway is simple: size your positions for the reality that even “confirmed” good news can vanish 18 minutes before the bell.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.