Compromised owner contract just let hackers print 5.2 million WEMIX stablecoins out of thin air, forcing a complete network freeze

The WEMIX staff stated compromised possession of a contract tied to its WEMIX$ stablecoin enabled roughly 5.23 million tokens to be minted with out authorization, prompting it to droop bridges, liquidity swimming pools, and several other providers on the WEMIX3.0 community.

Contract-owner breach examined WEMIX$’s 1:1 design

The WEMIX3.0 whitepaper describes WEMIX$ as 100% collateralized by USDC held in a Treasury and says its provide ought to stay equal to the Treasury’s USDC quantity. It additionally says minting is accessible solely by Approved Mint Entry, which is granted solely to the DIOS stability protocol.

WEMIX’s preliminary incident replace stated the irregular transactions started at 18:17 on July 26 (UTC+9), or 09:17 UTC, after possession of a WEMIX$-related contract was compromised.

Taken collectively, the 2 paperwork present that owner-level management was used to supply tokens exterior the whitepaper’s meant minting path. WEMIX has not disclosed the precise route by which that management was compromised, and its replace doesn’t set up that the USDC.e later moved by the attacker got here straight from the Treasury.

Associated Studying

Humanity Protocol hack turns one laptop computer breach into an identity-token disaster

A $36 million H exploit exhibits how one custody failure can threaten a venture constructed round digital identification belief.

Jun 10, 2026 · Liam ‘Akiba’ Wright

WEMIX stated the 5,225,525 unauthorized WEMIX$ was transformed into 30,736 items of the community’s native WEMIX token and 724,198.27 USDC.e, the bridged stablecoin used on WEMIX3.0. The corporate particularly stated the transformed USDC.e was bridged to Ethereum and BNB Sensible Chain, swapped into belongings together with ETH and USDT, and distributed amongst a number of addresses. A few of these belongings had been later deposited at centralized exchanges.

The nominal variety of tokens minted doesn’t set up a $5.23 million loss. WEMIX has not issued a closing loss estimate or recognized the exchanges concerned. It stated some exchanges froze attacker-associated addresses after receiving cooperation requests, however didn’t quantify the frozen quantities or state whether or not particular person person balances suffered losses.

Associated Studying

Polkadot Hyperbridge April Fools’ joke comes true as over 1 Billion faux DOT tokens had been minted on Ethereum

A proof replay bug let the attacker mint over $1 billion DOT tokens on Ethereum, but shallow DOT swimming pools capped the cashout close to $240,000.

Apr 13, 2026 · Oluwapelumi Adejumo

Containment reached bridges, buying and selling, video games and NFTs

WEMIX’s July 26 response listed each bridge related to and from WEMIX3.0 as suspended, together with its Chainlink CCIP route and PLAY Bridge. The announcement didn’t attribute the compromise to Chainlink or report a CCIP failure.

Associated Studying

Crypto customers advised to drag funds after Ethereum L2 bridge failure exposes rollup exit danger

The incident compelled customers to confront the a part of rollup safety that normally stays invisible: whether or not they can nonetheless withdraw when the bridge layer breaks.

Jun 23, 2026 · Liam ‘Akiba’ Wright

The replace additionally listed buying and selling within the WEMIX-USDC.e, WEMIX-WEMIX$, CROW-WEMIX$, TIPO-WEMIX$ and PLAY-WEMIX$ swimming pools as halted. The WEMIX$ Module and PNIX DEX had been paused, blockchain-linked options in some video games had been restricted, and NFT market buying and selling and bidding had been disabled.

The disruption adopted WEMIX’s September 2025 announcement that it could part WEMIX$ out in favor of USDC.e whereas persevering with conversions by the WEMIX$ Module. That module was among the many providers listed as suspended within the July 26 incident replace.

WEMIX had not offered a reopening timetable in that replace. The unresolved trigger, closing impression, frozen quantities and potential person losses depart the scope of the incident depending on the corporate’s subsequent findings.