WEMIX Reports $724K Theft After Stablecoin Contract Breach

Layer-1 blockchain network WEMIX reported an attacker moved approximately $724,000 in USDC.e tokens after compromising ownership of a contract linked to its WEMIX$ stablecoin on Sunday at 9:17 UTC. The breach enabled unauthorized issuance of about 5.23 million WEMIX$ tokens, which were converted into 30,736 WEMIX and 724,198.27 USDC.e before being bridged to Ethereum and BNB Smart Chain. WEMIX suspended all bridges connected to its WEMIX3.0 network and requested asset freezes from centralized exchanges, with some exchanges already freezing addresses linked to the incident.

Attacker Converts 5.23 Million WEMIX$ Across Multiple Chains

The abnormal transactions occurred on Sunday at 9:17 UTC, according to a preliminary incident update from WEMIX. The attacker issued about 5.23 million WEMIX$, which was converted into 30,736 WEMIX and 724,198.27 USDC.e. The USDC.e was then bridged to Ethereum and BNB Smart Chain before being exchanged for assets including Ether and Tether's USDT and distributed across multiple addresses.

WEMIX said some of the funds were deposited into centralized exchanges. The company identified the attacker's wallets and requested asset freezes and assistance from exchanges and stablecoin issuers.

WEMIX Suspends Bridges and Requests Exchange Asset Freezes

The company temporarily suspended all bridges connected to its layer-1 network, WEMIX3.0, including Chainlink CCIP and the PLAY Bridge. It also suspended trading in affected liquidity pools, withdrew foundation-provided liquidity, and paused services including the WEMIX$ Module and PNIX decentralized exchange.

Some exchanges had already frozen addresses linked to the incident, according to WEMIX.

Investigation Ongoing with Preliminary Figures Subject to Change

WEMIX said the cause and full impact remain under investigation and warned that the preliminary figures could change.

FAQ

What happened to WEMIX on Sunday at 9:17 UTC?

An attacker compromised ownership of a contract linked to WEMIX's WEMIX$ stablecoin and issued about 5.23 million WEMIX$ tokens without authorization. The attacker converted these into 30,736 WEMIX and 724,198.27 USDC.e, then bridged the USDC.e to Ethereum and BNB Smart Chain before exchanging for assets including Ether and USDT.

How did WEMIX respond to the security breach?

WEMIX temporarily suspended all bridges connected to WEMIX3.0, including Chainlink CCIP and PLAY Bridge. The company also suspended trading in affected liquidity pools, withdrew foundation-provided liquidity, paused the WEMIX$ Module and PNIX decentralized exchange, identified the attacker's wallets, and requested asset freezes from centralized exchanges and stablecoin issuers.