A hacker took ownership of WEMIX's stablecoin contract, and the stablecoin is now worth a penny

Ownership of a smart contract is the keys to the building. Whoever holds it can usually do the things no user can: pause it, upgrade it, and on a token contract, print. On 26 July somebody who was not WEMIX came to hold the keys to WEMIX$, and used them.

WEMIX is the blockchain arm of Wemade, one of South Korea’s larger game publishers. WEMIX$ is its dollar stablecoin, the unit its games and marketplaces price things in. According to WEMIX’s own account, the abnormal transactions started at 18:17 Korean time, 09:17 UTC. The company says “the ownership of a WEMIX$-related contract was compromised and used to issue WEMIX$ without authorization and transfer USDC.e to external addresses.”

The number it gives is 5,225,525 WEMIX$. Not stolen from a vault. Created, out of nothing, by the contract’s own mint function, working exactly as designed for whoever holds the keys.

WEMIX confirming the incident on X, 26 July 2026.

Where the money actually went

WEMIX says the 5,225,525 newly minted tokens were “subsequently converted into 30,736 WEMIX and 724,198.27 USDC.e”. At a dollar each the mint reads like $5.2m. What the attacker actually extracted was 724,198 USDC.e, plus 30,736 WEMIX worth roughly $6,700 at Monday’s price. Around $731,000 of real assets.

The gap between those two numbers is the story. The attacker sold 5.2m fake dollars into WEMIX’s own liquidity pools, and the pools paid out until they had nothing left to pay with. Every dollar of that difference was destroyed inside the pools rather than carried away. Adding the mint and the extraction together to reach a single headline figure counts the same money twice.

The USDC.e did leave. WEMIX says it went across bridges to Ethereum and BNB Smart Chain, was swapped into ETH and USDT, spread across several wallets, and partly deposited at centralised exchanges. Freeze requests have gone to those exchanges and to stablecoin issuers, and WEMIX says some exchanges have completed freezes.

What got switched off

The response reads less like patching a bug and more like pulling every lever at once:

A chain that cuts every route off itself is a chain that does not yet know how far the compromise reaches. WEMIX says a comprehensive inspection of related contracts “and contracts with similar structures” is under way, which is the sentence that should worry holders most: it means the company cannot yet rule out that whatever gave up the WEMIX$ keys also gave up others.

The stablecoin did not survive it

WEMIX$ traded at about a dollar on Saturday. It now changes hands at roughly $0.0109, down about 99 per cent in twenty four hours, having touched $0.00015 on 26 July. Its entire market is a single venue, WEMIX’s own WEMIX.Fi. Total supply stands at 14.5m tokens, of which more than a third are the ones the attacker conjured.

That is the difference between this and an ordinary theft. A stablecoin is a promise that one token equals one dollar. Once anybody can mint without backing, the promise is not broken temporarily, it is disproved. WEMIX itself, the chain’s gas coin, fell about 8 per cent to $0.2193, which by comparison is a shrug.

Faster than last time

WEMIX has been through this. In its own disclosure of the 2025 incident, the company said 8,654,860 WEMIX were abnormally withdrawn from the Play Bridge Vault on 28 February 2025 in 13 transactions to two attacker wallets, and that 8,630,223 of them moved through 77 addresses into seven exchanges. That announcement came on 3 March, three days later.

This time the first public notice went out at 14:50 UTC, 5 hours and 33 minutes after the attack, with the detailed account following at 20:07 UTC. The company was still careful to label its figures preliminary and subject to change, which is the correct thing to say and a reminder that every number here is WEMIX’s own first pass.

Speed of disclosure is the one variable a company fully controls after an incident. WEMIX has clearly learned that lesson. Whether it has learned the one about who holds the keys to a mint function is the question its contract inspection will answer.