Overview

• Six days before the exploit a malicious actor gained multisig admin and bridge roles via CrediX’s ACLManager, creating a single point of failure.
• The attacker minted unbacked collateral tokens to borrow against the protocol’s liquidity and drained $4.5 million from CrediX.
• Blockchain security firm CertiK reports that the stolen assets were routed through Sonic and bridged into three Ethereum wallets.
• CrediX has taken its website offline and launched an investigation with a pledge to recover all user funds within 48 hours.
• The incident highlights a wider surge in multisig wallet failures that accounted for $3.1 billion in DeFi losses in the first half of 2025.