WEMIX suspends bridges and trading after $724K breach
The blockchain gaming platform halts operations after an attacker exploits a linked contract, marking its second major security incident in under 18 months
WEMIX, the blockchain gaming platform built by South Korean publisher Wemade, has shut down its bridges and decentralized exchange trading after an attacker drained roughly $724,000 in USDC.e tokens through a linked contract exploit.
The platform suffered a separate, much larger breach back in February 2025 that cost it over 8.65 million WEMIX tokens, worth approximately $6.2 million at the time.
What happened this time
The latest incident targeted a contract linked to WEMIX’s infrastructure, allowing the attacker to move about $724K in USDC.e tokens before the team could intervene. In response, WEMIX suspended both its bridge services and DEX trading, effectively freezing cross-chain movement and on-platform swaps.
WEMIX had been in the process of transitioning from its native WEMIX$ stablecoin to USDC.e on its WEMIX3.0 network, a migration that kicked off around March to April 2026. That transition involved significant liquidity adjustments, which may have introduced new attack surfaces.
A pattern of security problems
The February 2025 breach saw attackers compromise the Play Bridge Vault, making off with over 8.65 million WEMIX tokens valued at around $6.2 million. That incident prompted a temporary service halt, a token buyback plan to stabilize the market, and a collaboration with blockchain security firm Theori to conduct a forensic analysis.
At the time, WEMIX CEO Kim Seok-Hwan oversaw the response. The platform eventually resumed operations, but the incident left a mark on investor confidence in the WEMIX ecosystem.
The stablecoin transition adds complexity
The move from WEMIX$ to USDC.e was supposed to simplify the platform’s stablecoin infrastructure. Liquidity migrations require rewriting or redeploying contracts, adjusting permissions, and reconfiguring how funds flow between wallets and pools. The latest exploit suggests at least one of those points was not adequately secured.
What this means for investors
For anyone holding WEMIX tokens or using the platform’s DeFi services, the immediate concern is straightforward: when do bridges and trading resume, and will there be further losses discovered during the investigation? Neither question has a clear answer yet.
The key metric to watch is how long the suspension lasts. In the 2025 incident, WEMIX resumed operations relatively quickly and backed it up with a buyback program to restore confidence.