CrediX Protocol Halts Operations Following $4.5 Million Hack

The DeFi lending platform CrediX, built on the Sonic blockchain, was attacked and lost approximately $4.5 million in cryptocurrency. The project team has temporarily taken down the website.

The breach occurred on August 4 at around 12:30 PM UTC+3.

«The website has been disabled to prevent users from making deposits. Please use the smart contracts to withdraw your funds,» CrediX cautioned.

Protocol representatives assured affected users that their assets would be reimbursed within 24 to 48 hours.

PeckShield analysts reported that the attack was made possible by the compromise of an administrator account.

This account had access to several functionalities, including POOL_ADMIN, ASSET_LISTING_ADMIN, EMERGENCY_ADMIN, RISK_ADMIN, and BRIDGE. The latter permitted the attacker to deposit or borrow assets, leading to the issue of unsecured acUSDC tokens.

According to SlowMist, just six days before the incident, an attacker’s address was granted administrator and bridge access to CrediX’s multi-signature wallet through ACLManager.

«This allowed the perpetrator to mint collateral tokens directly for themselves while acting as a bridge. Thus, the hacker managed to borrow a significant volume of assets, draining the pool,» the experts explained.

As per data from CertiK, following the attack, the stolen cryptocurrency was transferred from the Sonic network to Ethereum. At the time of writing, the stolen coins are spread across three different addresses.

It’s worth noting that researchers from Global Ledger identified the speed with which funds are withdrawn post-hack as a major issue facing the crypto industry. Analysts stated that in the first half of the year, hackers stole over $3.01 billion across 119 incidents.