WEMIX said a compromised contract owner let roughly 5.23 million WEMIX$ stablecoins be minted without authorization, and the team suspended every bridge, several trading pools, and parts of its games and NFT marketplace. The attacker converted the tokens into WEMIX and USDC.e, then moved the proceeds to Ethereum and BNB Smart Chain. WEMIX has published neither a final loss figure nor a reopening timetable.
WEMIX suspended bridges, liquidity pools and several services across its WEMIX3.0 network after compromised ownership of a contract tied to the WEMIX$ stablecoin let approximately 5.23 million tokens be minted without authorization. The abnormal transactions began at 18:17 on July 26 (UTC+9), or 09:17 UTC, after that contract ownership was compromised.
Owner-level control sat outside the whitepaper's minting path
The WEMIX3.0 whitepaper describes the stablecoin as 100% collateralized by USDC held in a Treasury and says its supply should remain equal to the Treasury's USDC volume. It also says minting is accessible only through Authorized Mint Access, granted solely to the DIOS stability protocol.
Taken together, the whitepaper and the incident update show that owner-level control produced tokens outside the intended minting path. However, WEMIX has not disclosed the exact route by which that control was compromised, and its update does not establish that the USDC.e the attacker later moved came directly from the Treasury.
Proceeds landed on Ethereum and BNB Smart Chain
WEMIX said the 5,225,525 unauthorized WEMIX$ was converted into 30,736 units of the network's native WEMIX token and 724,198.27 USDC.e, the bridged stablecoin used on WEMIX3.0. The company said that converted USDC.e was bridged to Ethereum and BNB Smart Chain, swapped into assets including ETH and USDT, and distributed among multiple addresses, with some of those assets later deposited at centralized exchanges.
The nominal token count does not establish a $5.23 million loss, and WEMIX has issued no final loss estimate or identified the exchanges involved. It said some exchanges froze attacker-associated addresses after receiving cooperation requests, but did not quantify the frozen amounts or state whether individual user balances suffered losses.
Containment reached trading, games and NFTs
The July 26 response suspended every blockchain bridge into and out of WEMIX3.0, including its Chainlink CCIP route and PLAY Bridge. Yet the announcement did not attribute the compromise to Chainlink or report a CCIP failure.
WEMIX also halted trading in the WEMIX-USDC.e, WEMIX-WEMIX$, CROW-WEMIX$, TIPO-WEMIX$ and PLAY-WEMIX$ pools. The team paused the WEMIX$ Module and PNIX DEX, restricted blockchain-linked features in some games, and disabled NFT marketplace trading and bidding.
The disruption followed WEMIX's September 2025 announcement that it would phase WEMIX$ out in favor of USDC.e while continuing conversions through the WEMIX$ Module — one of the services the July 26 update listed as suspended. WEMIX gave no reopening timetable, and the token sits 5.42% lower over the past 24 hours at rank #170 by market cap.
Sources: WEMIX, CryptoSlate
Trading involves risk.
Risk Disclaimer
