Wemix says delay in disclosing $6.2 million hack was to prevent panic: report

South Korea's Wemix Foundation CEO Kim Seok-hwan said the four-day delay in announcing a $6.2 million exploit was to prevent market panic. At a press conference on Monday, 17 days after the hack, Kim denied any intention to conceal the security breach.

Wemix, the blockchain subsidiary under South Korean game developer Wemade, announced on March 4 that a malicious attacker stole around 8.65 million Wemix tokens from its Play Bridge. The exploit, worth $6.2 million, was notified to investors four days after it happened.

Kim acknowledged that it was his decision to delay the disclosure, accepting full responsibility for the resulting criticism and apologizing to investors at the conference, according to a report from Yonhap news agency.  "We did not make an immediate announcement because prematurely publicizing information without identifying the method of the exploit could expose us to further attacks," Kim reportedly explained. 

According to Kim, the market was already affected, as most of the stolen assets had been sold. The team was concerned about the panic an immediate announcement might cause, as well as the possible risks of more attacks, Kim said.

Professional hack, not Lazarus

While the attacker remains on the loose, the Wemix CEO revealed that the perpetrator appears to be a professional — having infiltrated the system by stealing a service monitoring authentication key for its NFT platform Nile. Kim reportedly said that the hacker prepared the attack for two months before making 15 withdrawal attempts by creating abnormal transactions, where 13 succeeded.

The Wemix CEO stated the team immediately shut down the compromised server for analysis and reported the incident to local police to apprehend the unidentified attacker. Kim said the investigation currently believes it is unlikely that the hack was carried out by Lazarus, the notorious hacker group backed by North Korea.

According to CoinGecko data, Wemix token price dropped over 18% on Feb. 28, from around $0.7 to a low of $0.56. The price further slumped to $0.42 on March 4, marking a 40% fall in the four days between the exploit and the announcement.

Buyback

In an attempt to mitigate the situation, the Wemix Foundation announced on March 13 that it will buy back 10 billion Korean won ($6.9 million) worth of Wemix tokens from local exchanges to restore its pre-hack market value. The foundation announced the following day that it would purchase an additional 20 million tokens.

Wemix token briefly spiked to its pre-hack levels of above $0.70 as the foundation started the buyback last Saturday — but is trading at around $0.60 at the time of publication.

According to Yonhap, Kim said that the team will reopen full Wemix services on Friday with upgraded security measures on a new blockchain infrastructure.