WEMIX Freezes Key Services After 5.23M WEMIX$ Minted in Contract Ownership Breach

WEMIX said an attacker gained control of the owner privileges for a contract linked to its WEMIX$ stablecoin, enabling the unauthorized minting of roughly 5.23 million tokens. In response, the project suspended bridges, liquidity pools and multiple services across the WEMIX3.0 network. According to the WEMIX3.0 whitepaper, WEMIX$ is designed to be fully backed 1:1 by USDC held in a Treasury, with circulating supply intended to match the Treasury's USDC balance. The document also states that minting should be possible only via Authorized Mint Access, granted exclusively to the DIOS stability protocol. In a preliminary incident update, WEMIX said abnormal transactions began at 18:17 on July 26 (UTC+9), or 09:17 UTC, after ownership of a WEMIX$-related contract was compromised. The description indicates that owner-level control was used to mint tokens outside the route described in the whitepaper. WEMIX has not disclosed how the owner access was obtained, and it has not said whether USDC.e later moved by the attacker came directly from the Treasury. WEMIX said 5,225,525 unauthorized WEMIX$ was converted into 30,736 WEMIX (the network's native token) and 724,198.27 USDC.e, the bridged stablecoin used on WEMIX3.0. It added that the USDC.e was bridged to Ethereum and BNB Smart Chain, swapped into assets including ETH and USDT, and spread across multiple addresses, with some funds later deposited to centralized exchanges. The headline mint amount does not by itself confirm a $5.23 million loss. WEMIX has not released a final loss estimate or identified the exchanges involved. It said certain exchanges froze attacker-associated addresses after receiving cooperation requests, but did not disclose the amounts frozen or whether users incurred losses. On containment measures, WEMIX said it halted every bridge connected to WEMIX3.0, including its Chainlink CCIP route and PLAY Bridge. The announcement did not attribute the incident to Chainlink or cite a CCIP failure. Trading was also stopped in several pools, including WEMIX–USDC.e, WEMIX–WEMIX$, CROW–WEMIX$, TIPO–WEMIX$ and PLAY–WEMIX$. WEMIX said it paused the WEMIX$ Module and PNIX DEX, restricted blockchain-linked features in some games, and disabled NFT marketplace trading and bidding. The disruption follows WEMIX's September 2025 plan to phase out WEMIX$ in favor of USDC.e, while continuing conversions through the WEMIX$ Module—one of the services listed as suspended in the July 26 update. No timetable for reopening was provided. WEMIX said further findings would determine the root cause, final impact, frozen amounts and any potential user losses.