On February 28, hackers withdrew 8.6 million WEMIX tokens from the Play Bridge Vault, a platform designed to facilitate cross-chain transfers. Despite the incident being detected immediately, Wemix did not announce the hack until four days later. CEO Hwang Kim Seok explained that the delay in announcing was part of a “strategic decision” to minimize the impact of the attack and prevent panic among users.
He said that the market had already adapted to the situation by the time the official announcement was made, and that publishing the news prematurely could have triggered a new wave of asset sell-offs. Hwang also emphasized that this was his personal decision and apologized for the inconvenience caused. He noted that the company will strengthen security measures to prevent such incidents from recurring.
During the investigation, it became known that hackers used the stolen authentication key of Nile, a platform for creating NFTs owned by Wemix. The system was vulnerable for two months, and the attackers used this time to manipulate before starting a series of unauthorized withdrawals.
The hackers attempted to conduct 15 transactions, of which 13 were successful. The tokens sold on the exchanges were transferred outside of South Korea. After the company discovered the hack, Wemix turned off its servers and launched an internal investigation. A report was also filed with the Seoul National Police Cybercrime Investigation Department.
This incident was not the first case of a hacker attack in February 2025. Earlier, neobank Infini suffered, which lost 49.5 million USDC stablecoins. Infini founder Christian Lee attempted to contact the hacker, offering him 20% of the stolen amount as a reward for returning the funds. If the hacker agreed, there would be no legal consequences for him.