WEMIX Security Breach Overview
WEMIX has reported a significant breach involving its WEMIX$ stablecoin after an unauthorized actor gained control of owner privileges related to the coin’s smart contract on July 26. This security incident enabled the perpetrator to create new tokens without necessary approvals, resulting in substantial disruptions within multiple blockchain networks. According to an early report from Korea, these unauthorized activities resulted in approximately $6.25 million in unusual token issuances and asset transfers, while WEMIX later clarified that around 5.23 million WEMIX$ were minted in total.
Immediate Actions Taken
The situation escalated when WEMIX announced the suspension of bridge services and trading of its native token, WEMIX, following the exploit that led to a theft estimated at nearly $724,000. Currently, the network has taken measures to freeze the affected funds and halt vital operations while an investigation is underway. This incident was first detected around 9:17 UTC (6:17 PM local time in South Korea).
Investigation and Response
In response to the incident, WEMIX identified potential wallets associated with the attacker and has requested exchanges and other stablecoin providers to assist in freezing the implicated assets. The company is collaborating with blockchain security firms to trace the transactions but has yet to disclose the specifics concerning how the breach occurred, emphasizing that initial estimates could be subject to revision.
According to WEMIX’s updates, the attacker managed to mint approximately 5,225,525 WEMIX$ without consent, which were subsequently converted into 30,736 WEMIX tokens and 724,198.27 USDC.e. This breakdown of conversions contrasts with earlier estimates, which encompassed a broader range of suspicious transactions reported on the blockchain.
The attacker further transferred USDC.e to both the Ethereum and BNB Smart Chain networks and exchanged portions of the funds for various cryptocurrencies, including ETH and USDT. WEMIX has confirmed that requests for freezing activities have been met by several exchanges; however, the names of these exchanges, as well as the amount of funds currently safeguarded or still under attacker control, remain undisclosed.
Impact on Users and Services
As of now, WEMIX has not clarified whether any regular user balances were impacted and has not released a comprehensive list of compromised contracts or the amounts recoverable. This information is crucial, as the nominal value of minted tokens does not accurately reflect the total that was successfully converted and extracted from the network.
To mitigate further risks, WEMIX has halted all bridges linked to its WEMIX3.0 network, affecting services like Chainlink CCIP and the PLAY Bridge. Trading for liquidity pools deemed affected has also been paused, and the team has removed liquidity provided by the foundation while suspending the WEMIX$ Module and PNIX decentralized exchange to prevent additional transfers while conducting a thorough review of contract permissions and related systems.
Ongoing Investigation and Future Steps
WEMIX has publicly acknowledged the abnormal transactions and is currently investigating the root causes while implementing emergency measures. They have promised to keep their community updated through official channels, advising against relying on unverified reports. WEMIX indicated that it may involve law enforcement as they track down valuable evidence related to the attack.
Originally designed to mirror the value of the U.S. dollar on the WEMIX3.0 platform, the stablecoin’s value has been significantly impacted, plummeting to roughly 98.9% lower than its previous record following the incident.
Context of the Breach
This breach occurs at a time when WEMIX was in the process of transitioning from the WEMIX$ stablecoin to USDC.e across its gaming and financial platforms, a move first announced in March. The timeline of this switch set the stage for this incident amidst ongoing changes to the stablecoin’s usability. Furthermore, this incident comes a few months after another WEMIX security breach in February, where attackers stole 8.6 million WEMIX tokens valued at around $6.04 million. Following that breach, WEMIX faced criticism for the delay in disclosure, with prominent exchanges eventually delisting the token amid growing scrutiny.
