CrediX_fi Suffers $4.5 Million Loss After Admin Wallet Exploit

CrediX_fi, a decentralized exchange, has suffered a major security breach, resulting in a $4.5 million exploit. The attack was carried out by compromising an administrative wallet ending in 662e, which had access to multiple critical roles including POOL_ADMIN, BRIDGE, RISK_ADMIN, EMERGENCY_ADMIN, and ASSET_LISTING_ADMIN. These permissions enabled the intruder to mint unbacked acUSDC tokens on the Sonic USDC market, effectively draining liquidity from the platform’s pools without proper collateral [1].

Using the BRIDGE role, the attacker bypassed standard collateral requirements, allowing the unauthorized creation of value and subsequent withdrawal of funds. The breach exploited a lack of isolation mechanisms for admin roles in emergency situations, exacerbating the damage to the protocol’s infrastructure. This failure in architectural design and emergency response has raised serious concerns among investors and developers regarding the safety and future functionality of the platform [1].

In response, CrediX_fi has disabled its website and advised users to interact directly with its smart contracts to ensure the security of their assets. However, the lack of clear communication from the development team on post-incident auditing and security fixes has left users in uncertainty. Confidence in acUSDC and other related tokens has plummeted, and liquidity is expected to decline rapidly as holders close their positions [1].

The breach has also exposed deep flaws in the platform’s governance model. The centralization of roles into a single administrative structure created a critical single point of failure. The absence of transparency in remediation efforts has further eroded trust among stakeholders. As a result, calls are growing for an independent forensic audit and third-party security review to restore credibility and ensure the platform’s long-term viability [1].

Experts suggest that, unless such measures are implemented promptly, the protocol will struggle to regain user confidence or attract new investment. Investors are being urged to avoid new exposure to CrediX-related assets until these steps are taken. The incident serves as a stark reminder of the importance of robust permission management in decentralized finance platforms, not only to prevent financial loss but also to safeguard against systemic vulnerabilities [1].

Source:

[1] CrediX_fi Breach Triggers $4.5 Million Loss After Admin Role Exploitation

https://coinmarketcap.com/community/articles/6890b95090aa550a28eaa7ff/