Wemade's virtual currency "Wemix (WEMIX)" has been hacked again, putting the brakes on efforts to restore market trust. The incident has put domestic game companies' Blockchain and coin businesses back to the test. Game companies recently sought a rebound through rebranding and business shifts, but with delays in stablecoin legalization, a market slump, and now security incidents, observers say it will be difficult to avoid investors turning away and a drop in trust across the industry.
◇ 7.7 billion won in Wemix Dollar abnormally minted… smart contract vulnerability confirmed
According to the game industry on the 2nd, Wemade said on the 26th that the administrative authority over the Wemix Dollar smart contract was stolen, leading to the abnormal minting and outflow of 5,225,525 tokens. Wemix Dollar is a stablecoin pegged to the U.S. dollar. Wemade said the incident occurred not due to an internal system breach or an administrator private key leak, but through an attack that exploited weaknesses in the Blockchain transaction structure.
The attacker exploited a vulnerability in the initialization function of the smart contract to change the administrator address to an attack contract they created, then stole minting and exchange privileges. They then abused this to illicitly mint about 5,225,525 Wemix Dollars, equivalent to about 7.7 billion won, and transferred about 723,244 of them (about 1 billion won) externally. Separately, 34,752 standard Wemix coins were also transferred.
Wemade responded by immediately suspending the Wemix 3.0 consolidation bridge, Chainlink CCIP service, Play Bridge, and backend systems after detecting abnormal transactions. It also asked domestic and overseas virtual asset exchanges and stablecoin issuers to freeze the attacker's wallet and related assets, and said it is currently tracking the flow of funds.
However, with a hacking incident recurring on Wemix after 1 year and 5 months, the effort to restore trust has been hindered. In Feb. last year, about 8,650,000 Wemix coins (about 9 billion won at the time) were illicitly stolen in the "Play Bridge Vault" hack, and Wemade belatedly disclosed the incident, sparking controversy over delayed disclosure. It was subsequently delisted from major domestic virtual asset exchanges in Jun. last year.
Industry officials say this incident is more serious than the previous one because it was not a bridge vulnerability but a takeover of the administrative authority that controls token minting itself. The attacker was effectively in a position to mint Wemix Dollars without constraint. Since stablecoins maintain their value based on the issuer's control and credibility, observers say the incident has shaken that trust foundation itself.
◇ Game company coins plunge up to 99%… Blockchain business "on trial"
The incident is expected to further weigh on the Blockchain businesses of domestic game companies already experiencing a slump. NXPC, issued by Nexon's Blockchain affiliate Nexpace, fell more than 90%, from 4,500 won when it listed on a domestic exchange in May last year to 345 won recently. Nexpace announced a buyback plan of up to $10 million (about 1.48 billion won) in May, but it failed to reverse the downtrend.
Marblex (MBX), issued by Netmarble, has also fallen more than 99%, from the 50,000-won range at its May 2022 listing to 28 won now. XPLA by Com2uS Holdings is now 6 won, down more than 99% from the 1,100-won range at its Mar. 2023 listing. Kakao Games' BORA has also plunged 98% to 28 won compared to 2022, and Nexus's CROSS fell 75% in about a year after listing on Coinone.
In Korea, P2E (Play to Earn—earning income while playing games) has not been allowed, making it difficult to build token economic ecosystems and hindering the establishment of game coins. On top of this, the prolonged slump in the virtual asset market this year has pushed altcoins like game coins further out of investors' focus. In this situation, successive security incidents involving Wemix are likely to undermine trust in game companies' Blockchain businesses across the board.
Game companies have continued efforts to increase the utility of virtual currencies through rebranding and conversions to stablecoins, but observers say these moves fall short of reversing market sentiment. Industry officials note that unless coins prove practical utility, it will be difficult for game companies to secure sustainability in their Blockchain businesses.
A game industry source said, "With the prolonged slump in the virtual asset market, game coins are being shunned, and the hacking incident could further shake market trust," adding, "However, the Blockchain business is about building an ecosystem from a long-term perspective rather than generating short-term revenue, so ultimately, the success or failure of the business will depend on how robustly the ecosystem is built over the long term."