WEMIX Hit by Contract Exploit, Attacker Drains ~$724K in Assets

Attack Details

On Sunday, July 26, at 09:17 UTC, WEMIX (a Korean Layer-1 blockchain) suffered a contract exploit. Initial investigations show that the attacker took control of the WEMIX$ stablecoin contract ownership, unauthorized minting approximately 5.23 million WEMIX$, which was then swapped for 30,736 WEMIX and 724,198.27 USDC.e.

The USDC.e was subsequently bridged to Ethereum and BNB Smart Chain, converted to ETH and USDT, and distributed across multiple addresses, with some funds already sent to centralized exchanges.

Platform Response

WEMIX has suspended all cross-chain bridges (including Chainlink CCIP and PLAY Bridge), trading on affected liquidity pools, and withdrawn liquidity provided by the foundation. Additionally, the WEMIX$ Module and PNIX DEX have been paused.

The team has flagged the attacker’s wallet and requested assistance from exchanges and stablecoin issuers to freeze assets. Some exchanges have already responded. The investigation is ongoing, and initial figures may change.

Security Takeaways

This incident once again highlights that permission management for stablecoin contracts is a core defense line for on-chain security. A single point of vulnerability can lead to large-scale migration and liquidation of on-chain assets.