WEMIX says attacker moved about $724,000 after contract breach

[Updated July 27, 2026, 22:30 UTC: Included comments from a WEMIX spokesperson.]

Layer-1 blockchain network WEMIX said an attacker moved about 724,000 in USDC.e tokens after compromising ownership of a contract linked to its WEMIX$ stablecoin and issuing tokens without authorization. 

The abnormal transactions occurred on Sunday at 9:17 UTC, according to a preliminary incident update from WEMIX. The attacker issued about 5.23 million WEMIX$, which was converted into 30,736 WEMIX and 724,198.27 USDC.e. The USDC.e was then bridged to Ethereum and BNB Smart Chain before being exchanged for assets including Ether and Tether’s USDT and distributed across multiple addresses.

WEMIX said some of the funds were deposited into centralized exchanges. The company identified the attacker’s wallets and requested asset freezes and assistance from exchanges and stablecoin issuers, adding that some exchanges had already frozen addresses linked to the incident. 

The company temporarily suspended all bridges connected to its layer-1 network, WEMIX3.0, including Chainlink CCIP and the PLAY Bridge. It also suspended trading in affected liquidity pools, withdrew foundation-provided liquidity, and paused services including the WEMIX$ Module and PNIX decentralized exchange. 

A WEMIX spokesperson told Cointelegraph that the incident remains under internal investigation and that further updates will be provided when available. 

The spokesperson said WEMIX had identified the attacker’s wallets and fund movements and was actively tracking the assets, and requests for freezes and cooperation were submitted to relevant exchanges and stablecoin issuers. 

“Consequently, a portion of the externally transferred assets has been frozen,” the spokesperson told Cointelegraph, adding that no user-owned assets were affected.

Related: DeFi TVL drops 39% in 2026 amid market downturn and record hack activity