In Brief:
- A serious breach struck Wemade’s WEMIX ecosystem last Sunday, allowing more than 5 million stablecoins to be minted without permission.
- Part of that supply was swapped by the attacker into WEMIX and roughly $724,198 worth of USDC.e, which was then moved to exchanges.
- Trading and other services were halted by Wemade pending an investigation — all of it unfolding as the company changes hands.
Security breach hits WEMIX
On July 26, Wemade’s WEMIX blockchain ecosystem was struck by a significant security incident in which an attacker seized control of the smart contract behind the WEMIX$ stablecoin and minted roughly 5,225,000 tokens without authorization.
Irregular minting was first spotted at 9:17 UTC. Around 30,700 of the tokens were then swapped by the attacker into WEMIX and about $724,198 in USDC.e, with the proceeds routed across Ethereum and BNB Chain in the direction of exchanges.
The breach was publicly acknowledged by WEMIX at 16:30 UTC, described at first as a possible security problem tied to compromised contract ownership. Efforts were stepped up by 01:20 UTC on July 27, when Wemade halted bridges and trading and froze services across the network. Not long after, WEMIX PLAY — the ecosystem’s game storefront and marketplace — was placed under maintenance.
Some outlets put the total value of the hack at $6.25 million, a figure drawn from the face value of the minted tokens. On-chain analyses, however, point to a realized theft nearer $724,198, which implies the bulk of the minted supply may still be recoverable.
The timing is awkward: Wemade is in the middle of an ownership transition involving a Chinese investment group, and the future course of its blockchain plans remains unclear. The WEMIX token was listed on Kraken not long ago, a notable milestone for the ecosystem.