WEMIX suspended bridges and decentralized trading services after an attacker gained ownership control of a contract connected to its WEMIX$ stablecoin and minted 5,225,525 tokens without authorization.

The abnormal transactions began at 09:17 UTC on July 26, according to WEMIX’s update on the security issue and response measures (). The attacker converted the unbacked WEMIX$ issuance into 30,736 WEMIX and 724,198.27 USDC.e, then moved the USDC.e through bridges to Ethereum and BNB Smart Chain. The funds were later exchanged for ETH and USDT, distributed across multiple addresses, and partly deposited into centralized exchanges.

The $5.23 million figure represents the face value of the unauthorized stablecoin mint at WEMIX$’s intended dollar price. The confirmed conversions resulted in a significantly smaller pool of liquid assets before WEMIX halted the affected infrastructure, underscoring why stablecoin minting permissions and bridge routes are treated as high-risk control points in DeFi incident response.

WEMIX had already started replacing WEMIX$ with USDC.e across its gaming and DeFi services. During an April transition, the project withdrew foundation-provided liquidity and ended support for several WEMIX$ pools, according to its prior notice on the termination of WEMIX$ support and transition to USDC.e ().

Bridges and Liquidity Pools Suspended

All bridges connected to WEMIX3.0 were temporarily suspended, including Chainlink CCIP and the PLAY Bridge. Trading was also halted in affected liquidity pools, foundation-supplied liquidity was withdrawn, and services including the WEMIX$ Module and the PNIX decentralized exchange were paused.

On-chain investigator Specter flagged an address beginning with 0xc921a66e during the first public tracing of the transactions on X: https://x.com/SpecterAnalyst/status/2081336820642484659. WEMIX later identified additional wallets and requested freezes from centralized exchanges and stablecoin issuers. Some addresses had already been restricted while recovery efforts continued.

The exact method used to obtain ownership of the contract remains under investigation. WEMIX said it brought in external security specialists and expanded its review to related contracts with similar administrative controls. The review of similar controls is important because owner-level permissions can affect token issuance, liquidity management, or emergency functions depending on how individual contracts are designed.

Second Major WEMIX Breach in 17 Months

The contract takeover follows the February 2025 PLAY Bridge exploit, in which stolen authentication credentials allowed 8,654,860 WEMIX, then worth about $6.1 million, to be withdrawn from a bridge vault.

The WEMIX incident also came after a more than $9.7 million multichain drain from wallets linked to Triple-A, where assets moved from TRON, Ethereum, Polygon, and Arbitrum before being consolidated into 5,227 ETH. A malicious bridge import separately released $7.54 million from the Verus Ethereum Bridge, while an earlier signature flaw allowed 515 million NIGHT to leave Wanchain’s Cardano bridge treasury. Together, the incidents reflect a recurring security focus around cross-chain infrastructure, where stolen credentials, faulty verification, or compromised administrative access can turn a single system failure into movements across multiple networks.

WEMIX3.0 bridges, affected liquidity pools, the WEMIX$ Module, and PNIX remained suspended while the ownership compromise and final asset movements were reviewed.