Key Takeaways:
- Exploits discovered by WEMIX resulted in the minting of more than 5.22 million WEMIX$.
- The attacker swapped the assets for 724,198 USDC.e prior to transferring assets between multiple blockchains.
- The network shutdown bridges, liquidity pools, and other important services, and also had to work with exchanges to freeze assets.
On July 26, WEMIX announced a significant security incident that occurred within its WEMIX$ stablecoin system. The blockchain team has already implemented emergency measures and investigators are following the funds and the cause of the attack.
WEMIX Investigates Unauthorized WEMIX$ Minting
An official statement says that the said abnormal transactions started at 18:17 (UTC+9) on 26th July 2026. Initial analysis has shown that an attacker has taken control of one of the contracts linked to WEMIX$ and minted additional tokens.
The investigation has uncovered that another around 5,225,525 WEMIX was minted illegally. Then the attacker swapped the newly minted tokens for 30,736 WEMIX and approximately 724,198.27 USDC.e.
The $USDC.e was then bounced from the WEMIX blockchain to both Ethereum and BNB SmartChain (BSC) to be sold for assets such as ETH and USDT. Additionally, investigators authenticated that some of the funds made it to the centralized cryptocurrency exchanges.
WEMIX indicated that these are still preliminary and may be revised within the course of on-going forensic processing.
Read More: Venus Protocol Suspected of $3.7M Flash-Loan Attack
Emergency Measures Rolled Out Across the Ecosystem
WEMIX promptly turned on several emergency protections throughout its blockchain ecosystem to halt the event.
Bridges, Liquidity Pools, and Services Suspended
The temporary suspension of all the bridges linked to WEMIX3.0, such as the Chainlink CCIP and PLAY Bridge, further supports the prevention of further unauthorized transfers.
The foundation also temporarily suspended trading across all affected liquidity pools, including WEMIX-USDC.e, WEMIX-WEMIX$, CROW-WEMIX$, TIPO-WEMIX$, and PLAY-WEMIX$, while immediately withdrawing its own liquidity from those pools to help contain the incident and reduce further risk.
In addition, liquidity supplied by the WEMIX Foundation was withdrawn from the affected pools.
Several ecosystem services were also temporarily disabled, including the WEMIX$ Module, PNIX DEX, and supporting backend infrastructure. NFT marketplace trading, bidding functions, and selected blockchain features integrated into games were also restricted while security reviews were completed.
Read More: $5.87M Ethereum Exploit Hits TrustedVolumes as 1inch Denies Any Protocol Breach
Asset Recovery Efforts Underway
WEMIX said it has already identified the attacker’s wallet addresses and is actively monitoring fund movements across multiple blockchains.
Exchanges Begin Freezing Suspicious Assets
To date, the foundation has issued requests to several cryptocurrency exchanges and stablecoin issuers to place an asset freeze and cooperate in an investigation. As per this latest update, a few exchanges have already frozen addresses linked to the attacker.
In addition, efforts are underway to recover the compromised contract, complete an audit on that contract, and evaluate variants thereof that are currently being developed elsewhere. His primary objective was to find out how the attacker got this contract, and if there are more in the system.
Services are partly suspended, but preserving user assets and restoring the security of the ecosystem is WEMIX’s top priority, the company said. Additional announcements will give details of the findings, recovery and long-term security enhancements as the investigation progresses, the company said.
