WEMIX Stablecoin Compromised in Latest Crypto Security Breach On July 26, blockchain network WEMIX disclosed a security breach in which an attacker gained control of its WEMIX$ stablecoin, converting it into 30,736 WEMIX tokens and $724,198.27 in USDC. The stolen funds were then bridged to Ethereum and Binance Smart Chain (BSC), swapped into assets like ETH and USDT, and partially deposited into centralized exchanges. WEMIX stated that the investigation is ongoing, with attacker wallets and fund movements actively tracked. The company has requested asset freezes and cooperation from exchanges and stablecoin issuers. The incident follows a $2.4 million exploit targeting cryptocurrency wallet SecondFi earlier in the week, which forced the platform to wind down operations. This breach is part of a broader trend of high-profile crypto exploits in 2024, including the $292 million theft from Kelp DAO a DeFi platform whose attack triggered a cascading loss of nearly $9 billion across major DeFi lending protocols. Industry experts note the tension between crypto’s push for open, interoperable systems and institutional demands for security, with some suggesting such incidents may temporarily dampen confidence in DeFi adoption. In response to rising crypto theft, U.S. lawmakers introduced the Federal Cryptocurrency Theft Enforcement and Coordination Act last month. The bill, proposed by Reps. Lance Gooden (R-Texas) and Josh Gottheimer (D-N.J.), would establish a federal task force combining efforts from the Treasury, Justice, and Homeland Security departments, along with other law enforcement agencies, to combat crypto-related crimes and assist victims.

KelpDAO Suffers $292M Exploit Linked to North Korea’s Lazarus Group On April 18, decentralized finance (DeFi) protocol KelpDAO fell victim to a $292 million exploit, now confirmed to be the work of the North Korean state-backed Lazarus Group. The attack, the largest DeFi breach of 2026, targeted a vulnerability in the protocol’s cross-chain bridge, powered by LayerZero Labs’ infrastructure. The Lazarus Group executed a sophisticated attack by poisoning the decentralized validation network’s downstream RPC infrastructure. Through coordinated denial-of-service (DoS) attacks and control of key nodes, the threat actors manipulated the network into accepting malicious data, enabling them to forge cross-chain transactions. The incident highlights the growing sophistication of state-affiliated cyber threats in the DeFi space. Investigations revealed a critical architectural flaw in KelpDAO’s design a single-point-of-failure configuration using a one-of-one (1/1) validation setup. Despite industry warnings against such setups, the protocol lacked redundant verifiers, allowing the forged transactions to go undetected. The breach has prompted widespread industry action, with multiple DeFi platforms freezing their cross-chain bridges to prevent similar attacks. The fallout has been severe, triggering a liquidity crisis across major lending platforms like Aave as users rushed to withdraw assets amid fears of bad debt exposure. Total value locked (TVL) in DeFi has contracted sharply, reflecting heightened risk aversion. The incident has also reignited debates over the safety of restaked assets as collateral, pushing protocols toward institutional-grade security standards. As the DeFi sector grapples with the aftermath, the exploit underscores the vulnerabilities inherent in complex cross-chain architectures and the consequences of prioritizing speed over security. The event marks a turning point in how the industry assesses and mitigates systemic risks.