WEMIX Suffers Second Security Breach: $724K Stolen Through Unauthorized Token Minting

Key Points Unauthorized access to WEMIX$ stablecoin contract owner privileges occurred on July 26, enabling the minting of 5.23 million tokens. Stolen tokens were exchanged for 30,736 WEMIX and 724,198 USDC.e, then transferred across Ethereum and BNB Smart Chain. All WEMIX bridges, liquidity pools, PNIX exchange, and WEMIX$ Module operations were immediately suspended following the incident. Multiple cryptocurrency exchanges have frozen addresses connected to the breach after receiving emergency requests from WEMIX. This marks WEMIX’s second significant security incident since February 2025, when approximately $6 million was stolen from the network. WEMIX, a blockchain gaming platform, disclosed on July 26 that unauthorized parties had successfully gained administrative control over its WEMIX$ stablecoin smart contract. The security incident was detected at around 9:17 UTC. JUST IN: WEMIX suspends bridge services and wemix-token:native trading after an attacker exploited a linked smart contract, stealing approximately $724,000. The network has frozen affected funds and paused key services while the investigation continues. pic.twitter.com/2KUPwTgOd3 — EyeWhales (@EyeWhales) July 27, 2026 Exploiting this elevated access, the perpetrator created approximately 5.23 million WEMIX$ tokens through unauthorized minting operations. These illicitly generated tokens were subsequently exchanged for 30,736 WEMIX tokens and 724,198.27 USDC.e. The stolen USDC.e was then transferred via bridge protocols to both Ethereum and BNB Smart Chain networks. Following the cross-chain transfers, portions of the funds were exchanged for Ether and Tether’s USDT, with the proceeds distributed among numerous wallet addresses. A portion of the compromised assets eventually made its way to centralized cryptocurrency exchanges. WEMIX successfully traced the attacker’s wallet addresses and immediately reached out to both exchanges and stablecoin issuers with urgent freeze requests. The company has verified that multiple trading platforms have already locked the identified addresses. However, WEMIX has not disclosed which specific exchanges took action or provided details on the exact amount of frozen or recovered funds. Network-Wide Service Interruptions Implemented Following the security incident, WEMIX immediately implemented emergency measures by shutting down all bridging infrastructure connected to the WEMIX3.0 ecosystem. This included suspending both Chainlink CCIP and the PLAY Bridge services. All trading activity in impacted liquidity pools was frozen. WEMIX pulled foundation-backed liquidity from affected pools and disabled both the WEMIX$ Module and PNIX decentralized exchange platform while conducting a comprehensive audit of contract access permissions. According to WEMIX’s statement, the investigation into how the owner-level privileges were compromised remains ongoing. The team cautioned that preliminary damage estimates may be adjusted as their cross-chain investigation progresses. Market data from CoinGecko revealed that WEMIX$ plummeted to near its all-time low following news of the breach, experiencing a weekly price drop of approximately 98.9%. The collapse was triggered by the unauthorized token creation and subsequent rapid liquidation.