The post CrediX Hit by $4.5M Hack, Attacker Bridges Funds to Ethereum appeared first on Coinpedia Fintech News
The DeFi project CrediX has reportedly been hacked, with losses estimated at $4.5 million. The incident appears to be the result of a private key compromise, which allowed the attacker to gain unauthorized access to the system.
Credix seems to have had a security breach. We are investigating and will share details soon
As a safety step, CrediX has taken its website offline to block new user deposits. Security firm CertiK reported that the stolen funds were moved from the Sonic network to Ethereum. So far, the attacker’s wallet still holds the stolen assets, and there has been no further movement.
Cyvers Alerts, a Web3 security firm, also flagged multiple suspicious transactions on the Sonic network involving CrediX. According to them, an address funded via Tornado Cash on Ethereum bridged funds to Sonic, then borrowed around $2.64 million from CrediX.
ALERTOur system has detected multiple suspicious transactions on the #Sonic network involving @CrediX_fi.
An address funded by @TornadoCash on the #ETH network bridged funds to the #Sonic network and borrowed approximately 2.64M from @CrediX_fi.
On-chain security firm SlowMist notes that six days before the exploit was detected, the attacker was added as both Admin and Bridge to the CrediX Multisig Wallet using the ACLManager. With Bridge-level privileges, the attacker gained direct access to mint collateral tokens through the CrediX Pool.
Using the freshly minted tokens, they were able to borrow a large amount of assets from the protocol, ultimately draining the pool. This shows how risky it can get when access and roles are not properly managed in a multisig setup, and highlights how critical governance security is in DeFi systems.
All users funds will be recovered in full within 24-48 hours
Crypto Hacks Surge in 2025: $2.1 Billion Stolen in Just 6 Months
,
Multisig Hacks Lead 2025 Losses
According to a report from Hacken, crypto losses hit $3.1 billion in the first half of 2025, and most of it came from multisig wallet failures. These wallets were often exploited through fake interfaces and poor signer management.
The most damaging attack was the $1.46B Bybit hack, where signers were tricked by a spoofed UI.
Hacken Urges Real-Time Multisig Security
More than 80% of all crypto losses this year were caused by access control failures. Hacken now recommends that projects move away from one-time audits and adopt real-time, AI-driven security systems. These tools can track multisig wallet activity, detect abnormal behavior, and provide faster response times.
Hacken also advises that teams treat signers and user interfaces as key elements of the security system, not just technical features. Improved training, stricter automation, and tighter rules are necessary if DeFi platforms want to avoid similar attacks in the future.
function subscribed_popupmodal(template_id) { var templateId = ‘6’; getAllSubscriberCategoryList([templateId]); var subcribemodal = window.parent.document.getElementById(‘subscribe-modal-design’); if (subcribemodal) { var modalContent = `
Never Miss a Beat in the Crypto World!
Stay informed and gain the edge you need to navigate the crypto world. Select your subscription now
if (storeCheckedId.length === 0) { var unsubcribedPopUpmodal =
`
You’ve Unsubscribed Successfully
We’re sorry to see you go! Your subscription has been canceled. If you change your mind, you can re-subscribe anytime. Thank you for being part of our community!
Thank you for subscribing to our crypto and blockchain newsletter! You’ll now receive the latest news, insights, and updates straight to your inbox. Welcome to our community!
`;
let selectedSubscriptionsArray = selectedSubscriptionsString.split(‘,’); let subscribedCategories = selectedSubscriptionsArray.map(subscription => subscription.split(‘_’)[0]); let subscribedCategoriesString = subscribedCategories.join(‘, ‘);
subscribedmodal.innerHTML = subscribedPopupModal; if (document.getElementById(‘selectidname’)) { document.getElementById(‘selectidname’).textContent = subscribedCategoriesString; }
function closeModal(template_id) { var modalId = template_id; var modal = document.querySelector(‘#’ + modalId); // Using querySelector to find the modal
// Function to get cookies function getCookie(name) { let value = “; ” + document.cookie; let parts = value.split(“; ” + name + “=”); if (parts.length == 2) return parts.pop().split(“;”).shift(); }
// Get user token from cookies const userToken = getCookie(‘user_token’);
if (subscribewithoutData === ‘true’ && userToken) { // Call the modal function with the category ID subscribed_popupmodal(subscribe_clicked_cat_id);
// Remove the flag and category ID from localStorage localStorage.removeItem(‘subscribe_without_Login’); localStorage.removeItem(‘subscribe_clicked_id’); } });
var listItems = document.querySelectorAll(‘.subscription-options li’); if (listItems.length === 0) return;
var anyActive = false; listItems.forEach(function(item) { var checkbox = item.querySelector(‘input[type=”checkbox”]’); if (checkbox) { if (checkbox.checked) { item.classList.add(‘active’); anyActive = true; // Set anyActive to true } else { item.classList.remove(‘active’); // Remove ‘active’ class if checkbox is unchecked } } });
}
function updateButtonText(anyActive) { var subscribeButtonSpan = document.querySelector(‘.subscribe-submit .changeBtnText’); if (subscribeButtonSpan) { if (anyActive) { subscribeButtonSpan.textContent=”Subscribe Now”; } else { subscribeButtonSpan.textContent=”Unsubscribe”; } } }
function updateSubscriptionButton() { var listItems = document.querySelectorAll(‘.subscription-options li’); if (listItems.length === 0) return;
var anyActive = false; listItems.forEach(function(item) { var checkbox = item.querySelector(‘input[type=”checkbox”]’); if (checkbox) { if (checkbox.checked) { item.classList.add(‘active’); anyActive = true; // Set anyActive to true } else { item.classList.remove(‘active’); // Remove ‘active’ class if checkbox is unchecked } } });
// Update the button text based on whether any list item has the ‘active’ class updateButtonText(anyActive); } document.addEventListener(‘click’, function(event) { var clickedItem = event.target.closest(‘.subscription-options li’); if (clickedItem) { var checkbox = clickedItem.querySelector(‘input[type=”checkbox”]’); if (checkbox) { checkbox.checked = !checkbox.checked; updateSubscriptionButton(); } } });
FAQs
What caused the $4.5M CrediX hack?
The CrediX hack was caused by a private key compromise, allowing the attacker admin and bridge access to drain the pool.
Will CrediX users get their funds back?
Yes. CrediX has assured users that all stolen funds will be recovered within 24–48 hours after the exploit.
What are the biggest crypto hacks of 2025 so far?
Major 2025 hacks include $400M from Coinbase, $220M from Cetus, and millions more from BSC, Phemex, and UPCX exploits.