WEMIX says attacker moved about $724,000 after breach
WEMIX says attacker moved about $724,000 in USDC.e after compromising ownership of a contract linked to its WEMIX$ stablecoin and issuing tokens without authorization. The layer-1 network has suspended bridges, liquidity-pool trading and several services while investigating the incident and seeking freezes of attacker wallets.
Key Takeaways
- An attacker compromised a WEMIX$-linked contract and moved 724,198.27 USDC.e, WEMIX said in a preliminary update.
- About 5.23 million WEMIX$ was issued without authorization, then converted into 30,736 WEMIX and USDC.e.
- The USDC.e was bridged to Ethereum and BNB Smart Chain, swapped for assets including Ether and USDT, and spread across addresses.
- WEMIX paused WEMIX3.0 bridges, liquidity-pool trading, the WEMIX$ Module and PNIX DEX while seeking exchange freezes.
- Cause and full impact remain under investigation; preliminary figures could change.
What did WEMIX say happened in the breach?
According to a Cointelegraph report, layer-1 blockchain network WEMIX said an attacker compromised ownership of a contract tied to its WEMIX$ stablecoin. The attacker then issued tokens without authorization.
WEMIX flagged abnormal transactions at 9:17 UTC on Sunday in a preliminary incident update. In that account, the attacker issued about 5.23 million WEMIX$, which was converted into 30,736 WEMIX and 724,198.27 USDC.e.
That USDC.e total is the roughly $724,000 figure cited after the contract breach. WEMIX stressed that early numbers remain subject to revision as the probe continues.
Where did the stolen funds go after the move?
WEMIX said the USDC.e was bridged to Ethereum and BNB Smart Chain. From there, it was exchanged for assets including Ether and Tether's USDT and distributed across multiple addresses.
Some of the funds were deposited into centralized exchanges, the company said. It identified the attacker's wallets and asked exchanges and stablecoin issuers for asset freezes and assistance.
WEMIX added that some exchanges had already frozen addresses linked to the incident. The unauthorized path included minting, conversion, bridging, swaps and distribution.
Which WEMIX services were suspended after the attack?
WEMIX temporarily suspended all bridges connected to its layer-1 network, WEMIX3.0, including Chainlink CCIP and the PLAY Bridge. It also suspended trading in affected liquidity pools and withdrew foundation-provided liquidity from those pools.
Services paused include the WEMIX$ Module and the PNIX decentralized exchange. Those steps followed the unauthorized issuance and the cross-chain movement of USDC.e.
For more breach and market alerts, see BlasterPost's Fintech & Crypto Alerts hub. WEMIX said the cause and full impact remain under investigation, and it warned that preliminary figures could change.