21/09/2026
🔍 The day WEMIX$ collapsed, someone was already waiting at the pool
On July 26, when WEMIX$ lost its peg, most people were panicking.
But one on-chain address started moving at 11:04 AM. In 40 minutes it dumped 14,000 WEMIX into the WemixFi WEMIX-WEMIX$ pool and walked away with 1.05 million WEMIX$.
I went through every single transaction this address has ever made. Here's what it actually did.
━━━━━━━━━━━━━━
📅 June 22: The setup, one month early
This address's very first transaction wasn't a transfer. It deployed its own smart contract.
13 minutes later it ran three test swaps — 1, 5, and 1 WEMIX — to confirm the contract worked.
Then... nothing. For a full month.
Exchange rate at the time: 1 WEMIX ≈ 0.24 WEMIX$. Business as usual.
━━━━━━━━━━━━━━
💥 July 26, 11:04 AM: The pool breaks. The address wakes up.
Same contract, switched back on. First move: a single 1 WEMIX probe —
it came back with 275 WEMIX$.
A month earlier that was 0.24. Now it was 275. Over 1,100x.
WEMIX$ had gone to nearly zero inside this pool.
What happened next, in the address's own trade history:
11:04 → 1 WEMIX → 275 WEMIX$ (rate 274.8)
11:17 → 1,000 WEMIX → 223,906 WEMIX$ (rate 223.9)
11:18 → 1,000 WEMIX → 171,730 WEMIX$ (rate 171.7)
11:21 → 100 WEMIX → 9,465 WEMIX$ (rate 94.7)
11:28 → 4,500 WEMIX → 253,469 WEMIX$ (rate 56.3)
12:39 → 880 WEMIX → 30,062 WEMIX$ (rate 34.2)
13:43 → 2,200 WEMIX → 53,915 WEMIX$ (rate 24.5)
The rate got bought back from 275 all the way down to 24.5.
This address was buying the whole way up from the bottom — scooping up cheap WEMIX$ layer by layer.
Total: 14,329 WEMIX in → 1,049,917 WEMIX$ out.
━━━━━━━━━━━━━━
🔁 Where did the money come from? Where did it go?
The address itself barely had any capital. That same day, three wallets were feeding it WEMIX on one side and collecting the WEMIX$ it produced on the other:
• Wallet A (0xfa91…): sent 11,020 WEMIX → received 610,000 WEMIX$
• Wallet B (0x7067…): sent 3,300 WEMIX → received 230,000 WEMIX$
• Wallet C (0x8e67…): sent 10 WEMIX → received 51,000 WEMIX$
The people putting money in and the people taking product out are the same group.
So this isn't one person. It's a shared ex*****on wallet for a small team: others supply the capital, this address does the trading at the scene of the crash, and everything flows back to where it came from.
━━━━━━━━━━━━━━
🚪 The exit
• July 28: 1,000 WEMIX$ sent through the official bridge to BSC (recipient: the same address)
• July 29: ~106,000 WEMIX$ converted into WCD (WEMIX Crypto Dollar) and moved to two more wallets
• September 9 and 13: a few small trailing transactions — this address has not been abandoned
Today it holds 10 WEMIX and 1,906 WEMIX$. Basically emptied out.
━━━━━━━━━━━━━━
⚖️ Is this the hacker?
Let me be clear: there is no on-chain evidence that this address is the attacker.
Every WEMIX it used came from ordinary wallets via normal transfers. Not one coin traces back to an exploited contract or an abnormal mint.
The accurate label is "event arbitrageur."
It didn't cause the crash. But it anticipated that a crash would happen, built and tested its tool a month in advance, parked it, and then — during the 40 minutes everyone else was panicking — collected every cheap chip on the table.
━━━━━━━━━━━━━━
💡 Three takeaways for regular players
1️⃣ A depeg doesn't snap back. It took two and a half hours to go from 275 to 24.5, and it has never returned to 0.24. "Let me wait and see" is the most expensive decision you can make in that moment.
2️⃣ Someone deployed a contract a month early and waited for this day. When people inside an ecosystem have reason to expect trouble, the stablecoin in your wallet isn't stable.
3️⃣ All of this is public data. Anyone can check it. The chain doesn't lie — it just needs someone to look.
━━━━━━━━━━━━━━
🔗 Verify it yourself (all public data)
Address analyzed:
0xf747c4618f017fe9f696644407328f5b958b583d
Its self-deployed swap contract:
0xfd39f08e5483f85d2dd78ca78de6ccb64abe7c95
The WemixFi WEMIX-WEMIX$ pool that got drained:
0x00caec2e118abc4c510440a8d1ac8565fec0180c
Funding / payout wallets:
0xfa91bd51f70ead37b6321a2ba9aad7ca09719b27
0x7067e484be1089bb36a4c794a593bd44d425b9e9
0x8e67dd5405fd2840c60cfef0b405fc6edc1c0cce
WCD exit wallets:
0x25b79d6ab12e6102d326e060551f5b2941e3f768
0xee58b87a574a076190f62df625a8ab35b9fc51a9
Bridge (WEMIX$ → BSC):
0x445f863df0090f423a6d7005581e30d5841e4d6d
Paste any of these into wemixscan.com — every transaction is there.
Once more: none of these addresses has been shown by on-chain data to be the attacker. This post only describes what they did.
═══════════════════════════════
🇨🇳 中文版 / Chinese Version
═══════════════════════════════
🔍 WEMIX$ 崩盘那天,有人早就在池子边上等着了
7 月 26 日 WEMIX$ 脱锚那天,大部分人在恐慌。
但链上有一个地址,从上午 11 点 04 分开始,40 分钟里把 1.4 万枚 WEMIX 全砸进了 WemixFi 的 WEMIX-WEMIX$ 池子,换走了 105 万枚 WEMIX$。
我把这个地址从出生到现在的每一笔交易都翻了一遍,讲讲它到底干了什么。
━━━━━━━━━━━━━━
📅 6 月 22 日:提前一个月布好局
这个地址的第一笔交易,不是转账,是部署了一个自己写的合约。
13 分钟后,用 1 枚、5 枚、1 枚 WEMIX 试了三次兑换,确认合约能跑。
然后——整整一个月没有任何动作。
当时的汇率:1 WEMIX ≈ 0.24 WEMIX$,一切正常。
━━━━━━━━━━━━━━
💥 7 月 26 日 11:04:池子崩了,它醒了
同一个合约被唤醒。第一笔只投 1 枚 WEMIX 探路——
换回来 275 枚 WEMIX$。
一个月前是 0.24,现在是 275。1,100 多倍。
WEMIX$ 在这个池子里几乎归零了。
接下来它做的事,用它自己的成交记录说话:
11:04 → 1 WEMIX → 275 WEMIX$(汇率 274.8)
11:17 → 1,000 WEMIX → 223,906 WEMIX$(汇率 223.9)
11:18 → 1,000 WEMIX → 171,730 WEMIX$(汇率 171.7)
11:21 → 100 WEMIX → 9,465 WEMIX$(汇率 94.7)
11:28 → 4,500 WEMIX → 253,469 WEMIX$(汇率 56.3)
12:39 → 880 WEMIX → 30,062 WEMIX$(汇率 34.2)
13:43 → 2,200 WEMIX → 53,915 WEMIX$(汇率 24.5)
汇率从 275 一路被买回到 24.5。
它就是在这个"从谷底往上买"的过程里,一层一层把便宜的 WEMIX$ 吃干净的。
合计:投入 14,329 WEMIX → 换出 1,049,917 WEMIX$。
━━━━━━━━━━━━━━
🔁 钱从哪来?换完给了谁?
它自己其实没多少本金。当天有 3 个钱包一边给它打 WEMIX,一边收它换出来的 WEMIX$:
• 钱包 A(0xfa91…):打进 11,020 WEMIX → 收回 610,000 WEMIX$
• 钱包 B(0x7067…):打进 3,300 WEMIX → 收回 230,000 WEMIX$
• 钱包 C(0x8e67…):打进 10 WEMIX → 收回 51,000 WEMIX$
出钱的人和收货的人是同一批。
所以这不是一个人,是一个小团队的共用"兑换执行器":别人出本金,它负责在崩盘现场执行,换完原路返还。
━━━━━━━━━━━━━━
🚪 然后怎么离场?
• 7 月 28 日:1,000 WEMIX$ 走官方跨链桥到 BSC 链(收款地址就是它自己)
• 7 月 29 日:约 10.6 万 WEMIX$ 换成 WCD(WEMIX Crypto Dollar),转给另外 2 个钱包
• 9 月 9 日、9 月 13 日:还有零星尾单,这个地址至今没有废弃
现在账上只剩 10 枚 WEMIX、1,906 枚 WEMIX$,基本清空。
━━━━━━━━━━━━━━
⚖️ 它是黑客吗?
我要说清楚:链上没有证据说它是攻击者。
它用的每一枚 WEMIX 都来自普通钱包的正常转账,没有一枚来自被盗合约或异常铸造。
它的行为准确说是——"事件套利者"。
它没有制造崩盘,但它预判了崩盘会发生,提前一个月把工具做好、试好、放好,然后在别人恐慌的 40 分钟里,把便宜筹码全捡走。
━━━━━━━━━━━━━━
💡 给普通玩家的三个提醒
1️⃣ 脱锚不是瞬间恢复的。从 275 回到 24.5 用了 2 个半小时,从 0.24 到现在也没有回去过。"稍等一下再看"在这种时候是最贵的决定。
2️⃣ 有人提前一个月部署合约等这一天。当一个生态里有人有理由预期会出事,你手里的稳定币就不是稳定币。
3️⃣ 这些全是公开数据,谁都能查。链上不撒谎——它只是需要有人去看。
━━━━━━━━━━━━━━
🔗 自己查(全部公开数据)
分析地址:
0xf747c4618f017fe9f696644407328f5b958b583d
它自部署的兑换合约:
0xfd39f08e5483f85d2dd78ca78de6ccb64abe7c95
被砸的 WemixFi WEMIX-WEMIX$ 池:
0x00caec2e118abc4c510440a8d1ac8565fec0180c
出资 / 收款钱包:
0xfa91bd51f70ead37b6321a2ba9aad7ca09719b27
0x7067e484be1089bb36a4c794a593bd44d425b9e9
0x8e67dd5405fd2840c60cfef0b405fc6edc1c0cce
WCD 离场接收钱包:
0x25b79d6ab12e6102d326e060551f5b2941e3f768
0xee58b87a574a076190f62df625a8ab35b9fc51a9
跨链桥(WEMIX$ → BSC):
0x445f863df0090f423a6d7005581e30d5841e4d6d
到 wemixscan.com 粘地址就能核对,每一笔都在。
再说一次:以上地址没有任何一个被链上数据证明是攻击者,本文只描述它们做了什么。