WEMIX attacker mints millions, walks off with ~$724K in USDC.e 🍳

Layer-1 blockchain network WEMIX said an attacker moved approximately $724,000 in USDC.e after gaining control of a contract tied to its WEMIX$ stablecoin and minting tokens without authorization. The abnormal transactions were recorded on Sunday at 9:17 UTC, according to a preliminary incident update from the project.

The attacker issued about 5.23 million WEMIX$, which were then converted into 30,736 WEMIX and 724,198.27 USDC.e. The USDC.e was bridged to Ethereum and BNB Smart Chain before being swapped for assets including Ether and Tether's USDT and distributed across multiple addresses. WEMIX said portions of the funds were deposited into centralized exchanges.

WEMIX said it has identified the attacker's wallets and requested asset freezes and assistance from exchanges and stablecoin issuers, adding that some exchanges had already frozen addresses linked to the incident. The company also temporarily suspended all bridges connected to its WEMIX3.0 network, including Chainlink CCIP and the PLAY Bridge.

The project suspended trading in affected liquidity pools, withdrew foundation-provided liquidity and paused services including the WEMIX$ Module and PNIX decentralized exchange. WEMIX said the cause and full impact of the incident remain under investigation, and warned that the preliminary figures could change.