WEMIX$ Proxy Re-Initialization Exploit — DIOS/AMA Contract Takeover

T0 — July 26, 2026, 18:17 KST (09:17 UTC): In a single transaction, the attacker exploits a proxy re-initialization vulnerability affecting the DIOS and AMA contracts. Root cause (per WEMIX's official July 30 post-mortem): DIOS and AMA used an upgradeable proxy pattern where the owner address is set via an initialize() function that should only be callable once. During the third contract upgrade in November 2022, a code change altered the execution restriction on initialize(), permitting a second call. Because upgrading the implementation did not automatically re-run initialize(), the initialization counter remained at one, and no separate access control was applied to a second call — allowing any network participant to call initialize() again and register a new owner address. The attacker called initialize() a second time on both contracts, changing ownership to a malicious contract they had deployed, then authorized that contract to call mint and redeem functions. By alternating between AMA's redeem function and DIOS's price-adjustment minting logic across nine cycles of flash loans and swaps, the attacker minted 5,225,524.9997 WEMIX$ without authorization. T+detection: WEMIX's internal monitoring first flags abnormal movements in game token prices, triggering investigation. ~16:30 UTC: WEMIX publicly acknowledges abnormal WEMIX$ transactions. ~01:20 UTC July 27: WEMIX suspends all bridges connected to WEMIX3.0 (including Chainlink CCIP and the PLAY Bridge), pauses the WEMIX$ swap module, PNIX DEX, and multiple liquidity pools (WEMIX-USDC.e, WEMIX-WEMIX$, CROW-WEMIX$, TIPO-WEMIX$, PLAY-WEMIX$), and withdraws Foundation-provided liquidity. Some global exchanges independently suspend WEMIX deposits/withdrawals as a precaution. July 28, 2026, 13:00 KST (04:00 UTC): WEMIX files a formal criminal complaint with law enforcement and begins full cooperation, providing collected on-chain analysis data. July 30, 2026: WEMIX publishes a complete root-cause analysis and response update, confirming the technical vector, current asset-freeze status, and a comprehensive contract-review plan; this is the second major WEMIX security incident in roughly 17 months, following a ~$6M Play Bridge Vault exploit in February 2025.