South Korean crypto exchange Upbit listed Cluster Protocol and Useless Coin on Sept. 8 but canceled Hemi’s scheduled debut after identifying evidence of a token theft. Summary Upbit canceled HEMI trading after identifying token theft linked to a September 7 smart-contract exploit. The attacker drained approximately 124.5 million unclaimed HEMI and converted proceeds into stablecoins and Ether. CP began trading across Upbit’s KRW, BTC and USDT markets using deposits through Base exclusively. USELESS trading proceeded against BTC and USDT while Upbit abandoned HEMI before its scheduled opening. Hemi said its core tokens, network, tunnels and third-party bridges were unaffected by the exploit. Upbit initially announced that HEMI and USELESS trading would begin against Bitcoin and Tether at 9:30 p.m. Korea Standard Time. The exchange later updated its notice at 9:12 p.m., 18 minutes before the planned opening, to cancel HEMI support. The exchange said a security vulnerability had been exploited on the previous day and that HEMI tokens appeared to have been stolen. Upbit said it reviewed how the incident could affect trading before deciding not to open the markets. Upbit to List CP, HEMI and USELESS Across KRW, BTC and USDT MarketsSouth Korea’s largest crypto exchange Upbit announced new listings for Cluster Protocol (CP), Hemi (HEMI) and Useless (USELESS). CP will be available in KRW, BTC and USDT pairs; Cluster Protocol is an AI… pic.twitter.com/HMx27Y3ObH— Wu Blockchain (@WuBlockchain) September 8, 2026 Upbit canceled HEMI trading after 124.5 million tokens were stolen Hemi confirmed that an attacker exploited its legacy Genesis Drop contract at 03:36 UTC on Sept. 7. The project’s post-mortem said approximately 124.5 million unclaimed HEMI tokens were removed. The attacker used a reentrancy vulnerability in a modified MerkleBox contract. According to Hemi, the contract created token lockups before updating the remaining claimable balance. It also allowed users to configure claim groups with custom lockup contracts. The attacker created a malicious claim group and repeatedly called the claim function before its accounting updated. The operation used a two-million-HEMI flash loan and recursively executed the claim process 63 times. Hemi said the attacker sold about 80.15 million HEMI for approximately 158,200 USDT and another 41.4 million for roughly 84,900 USDC. About 2.95 million HEMI were exchanged for 0.3442 hemiBTC. The sales ultimately generated about $255,000 in stablecoins. The attacker moved the funds across Ethereum, Arbitrum, BNB Chain, Optimism, Avalanche and Polygon before converting most of the proceeds into Ether. Hemi said the attack involved only the Genesis Drop claim contract. It said the HEMI and veHEMI tokens, Hemi Virtual Machine, native tunnels and third-party bridging systems were not affected. These are project statements based on its internal investigation. CP and USELESS trading proceeded on Upbit Cluster Protocol began trading at 2:30 p.m. Korea time across Upbit’s KRW, BTC and USDT markets. Deposits and withdrawals are supported only through Base using Upbit’s specified contract. Upbit described Cluster Protocol as artificial intelligence infrastructure connecting models, data, GPU computing and AI agents through one interface and an onchain payment system. CP supports payments, staking and participant incentives within the protocol. The exchange initially restricted CP purchases for approximately five minutes. Sell orders priced at least 10% below the previous closing price were also restricted during that period. Only limit orders were available for the first two hours. USELESS trading proceeded against BTC and USDT at the planned 9:30 p.m. opening. Upbit supports deposits and withdrawals through Solana only. USELESS does not claim a technical utility. Upbit described it as a community-focused meme coin built around the satirical idea of promising no product or centralized development roadmap. The two listings follow Upbit’s recent expansion of smaller-token markets. In related coverage, the exchange added eight trading pairs for four altcoins in August. Upbit also recently introduced direct Korean won access for several tokens. Hemi faces recovery work and further exchange reviews Hemi said it identified the vulnerability roughly two hours and 44 minutes after the exploit occurred. The project contacted partners and later referred the incident to the SEAL 911 security response service. The project said no stolen HEMI remained under the attacker’s control because the tokens had already been sold. However, most converted proceeds remained in an Ethereum address associated with the attacker when Hemi published its report. Hemi did not announce reimbursements, a recovery deadline or a negotiated return of funds. It said it was tracing the proceeds, working with law enforcement and security firms, and exploring recovery options. Other exchanges may conduct their own reviews. Bithumb placed HEMI under an investment warning after identifying abnormal withdrawals from the Genesis Drop contract. That process could lead to additional restrictions unless the project addresses the exchange’s concerns. Upbit said it would strengthen its pre-listing review procedures after canceling HEMI trading. The exchange did not give a new listing date, and the cancellation means HEMI will require a fresh assessment before any future Upbit launch. The action comes as South Korean regulators continue examining exchange security and consumer protection. As crypto.news reported, authorities have opened sanctions proceedings against Upbit operator Dunamu over a separate wallet breach reported in November 2025.
