Layer-1 blockchain network WEMIX said an attacker moved approximately $724,000 in USDC.e after compromising ownership of a contract linked to its WEMIX$ stablecoin and issuing tokens without authorization.

According to a preliminary incident update from WEMIX, the abnormal transactions occurred on Sunday at 9:17 UTC. The attacker issued about 5.23 million WEMIX$, which was then converted into 30,736 WEMIX and 724,198.27 USDC.e.

WEMIX said the USDC.e was subsequently bridged to Ethereum and BNB Smart Chain. The funds were then exchanged for assets including Ether and Tether’s USDT and distributed across multiple addresses, a pattern that can make incident response depend on coordination across chains, exchanges, and token issuers.

Some of the funds were also deposited into centralized exchanges, according to the company. WEMIX said it had identified wallets used by the attacker and requested asset freezes and other assistance from exchanges and stablecoin issuers. It added that some exchanges had already frozen addresses connected to the incident.

In response to the breach, WEMIX temporarily suspended all bridges connected to its layer-1 network, WEMIX3.0, including Chainlink CCIP and the PLAY Bridge. The company also halted trading in affected liquidity pools, withdrew foundation-provided liquidity, and paused several services, including the WEMIX$ Module and the PNIX decentralized exchange. Those measures are aimed at containing activity around the affected assets while investigators assess the contract compromise and related transactions.

WEMIX said the cause of the incident and its full impact remain under investigation. The company cautioned that the figures disclosed in its preliminary update could change as the investigation continues.