WEMIX Attacker Moves $724,000 in USDC.e After Contract Compromise, Issues 5.23M Unauthorized Tokens

According to WEMIX's preliminary incident update, an attacker compromised ownership of a contract linked to its WEMIX$ stablecoin and moved about 724,000 USDC.e tokens on Sunday at 9:17 UTC. The attacker issued approximately 5.23 million unauthorized WEMIX$ tokens, which were converted into 30,736 WEMIX and 724,198.27 USDC.e. The USDC.e was then bridged to Ethereum and BNB Smart Chain before being exchanged for Ether, USDT, and other assets across multiple addresses, with some funds deposited to centralized exchanges.

WEMIX identified the attacker's wallets and requested asset freezes from exchanges and stablecoin issuers, with some exchanges already freezing related addresses. The company temporarily suspended all bridges connected to WEMIX3.0, including Chainlink CCIP and PLAY Bridge, and paused the WEMIX$ Module and PNIX decentralized exchange. The full cause and impact remain under investigation.