WEMIX freezes bridges and pools after $724,000 stablecoin hack
On July 26‑27 2026, an attacker compromised the ownership of a contract linked to WEMIX$ – the stablecoin of the South Korean blockchain gaming platform WEMIX. The breach allowed the creation of roughly 5.23 million unauthorized WEMIX$ tokens, which were immediately swapped into 30,736 WEMIX native tokens and about $724,198 USDC. The USDC was bridged to Ethereum and BNB Smart Chain, exchanged for Ether and Tether USDT, and dispersed across many wallets; a portion later appeared in centralized exchanges.
In response, WEMIX temporarily halted all cross‑chain bridges, including the Chainlink CCIP and Play Bridge, stopped trading in affected liquidity pools, withdrew foundation‑provided liquidity, and paused services such as the WEMIX$ module and the PNIX decentralized exchange. The company has identified the attacker’s wallets, requested asset‑freeze assistance from exchanges and stablecoin issuers, and continues to investigate the root cause and full impact of the incident.
The incident follows a prior, larger breach in February 2025 but, as of the latest update, the final loss figures and user impact remain uncertain.
Entities: Centralized exchanges · Chainlink · Chainlink CCIP · Kim Seok-hwan · Play Bridge · USDC · WEMIX · WEMIX$ · WEMIX$ stablecoin
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [● 9 SOURCES] The minted tokens were swapped for 30,736 WEMIX and about $724,198 USDC. (multiple articles)
- [● 9 SOURCES] The bridged USDC was exchanged for ETH and USDT and distributed across multiple addresses. (multiple articles)
- [● 9 SOURCES] The USDC was bridged to Ethereum and BNB Smart Chain. (multiple articles)
- [● 9 SOURCES] WEMIX temporarily suspended all bridges, including Chainlink CCIP and Play Bridge. (multiple articles)
- [● 9 SOURCES] The breach minted about 5.23 million unauthorized WEMIX$ tokens. (multiple articles)
- [● 9 SOURCES] Some of the proceeds were deposited into centralized cryptocurrency exchanges. (multiple articles)
- [● 9 SOURCES] WEMIX halted trading in affected liquidity pools and paused services such as the WEMIX$ Module and PNIX DEX. (multiple articles)
- [● 9 SOURCES] Attackers compromised ownership of the contract linked to WEMIX$ stablecoin. (multiple articles)