Overview

• An attacker gained multisig admin and bridge roles through a misconfiguration in the ACLManager six days before the breach.
• Elevated privileges allowed the actor to mint unauthorized collateral tokens to drain the protocol’s liquidity pool.
• Stolen assets were bridged from Solana’s Sonic network to Ethereum in a cross-chain laundering maneuver.
• CrediX took its site offline and assured users their funds remain secure and accessible via smart contracts.
• The exploit underscores the ongoing governance and access control risks facing real-world asset lending protocols.