Shocking Heist: $2.64 Million Vanishes from Credix’s DeFi Vault!

by
  • Exploiter gained multiple admin permissions
  • Bridge roles allow attackers to mint tokens, drain pools.
  • Privacy tools like Tornado Cash hide stolen cryptocurrency

So, picture this: a casual Tuesday morning, and suddenly, $2.64 million just does a Houdini act from Credix’s DeFi vault. Panic ensues, and I can only imagine the collective gasp from protocol users—like a room full of people who just realized they’ve been served decaf coffee at a caffeine convention. The blockchain watchdogs, Cyvers Alerts and SlowMist, were on the case faster than a cat on a laser pointer, and social media exploded with warnings that were as credible as your Aunt Linda’s conspiracy theories.

Source – X

In a stunning display of accountability, Credix’s official X account admitted to the leak, claiming their teams were on “high alert.” I can only assume that means they were all sitting around with coffee and donuts, waiting for the next disaster to unfold.

Source – X

Security experts at SlowMist chimed in with the kind of news that makes you want to throw your hands up in despair: “The CrediX Multisig Wallet, six days ago, Admin and Bridge were added as an attacker by ACLManager.” I mean, who knew that the real heist was the friends we made along the way? The site promptly went down, presumably to prevent any further deposits—because nothing says “we’re on top of this” like shutting the doors after the horse has bolted.

The Admin Role Breach That Cracked The Vault

Source – X

And here’s the kicker: the root cause of this debacle was a series of admin access blunders. Apparently, the Bridge role was like a VIP pass to a concert, but instead of enjoying the show, the attacker decided to take the whole stage. PeckShield reported that the “BRIDGE role is abused to drain pool assets.” One little permissions error, and poof! Millions vanished faster than my willpower at an all-you-can-eat buffet.

SlowMist elaborated, stating that the attacker minted collateral tokens to themselves using the Pool. It’s like borrowing your neighbor’s lawnmower and returning it with a full tank of gas—except the lawnmower is worth millions, and your neighbor is now very, very angry.

Multisig Trust Shattered – How Did This Go So Wrong?

Now, regulators are scrutinizing Credix, which just last year was basking in the glory of securing a $60 million credit line. Six days before the heist, the attacker managed to sneak in and grab both admin and bridge controller privileges, unnoticed—like a raccoon in a dumpster. They used the protocol’s own smart contracts to mint tokens and drain liquidity at will. Talk about a plot twist!

PeckShield found the hacked account on X, revealing that the permissions were all controlled by a single compromised address. It’s like giving your house keys to a stranger and then wondering why your TV is missing.

Blockchain detectives say Tornado Cash helped the attacker cover their tracks. Privacy mixers, as SlowMist and Cyvers realized, are like the world’s worst game of hide-and-seek—except the stakes are millions of dollars, and the seekers are left scratching their heads.

Credix assured users that their funds would remain accessible through smart contracts, even with the website down. They promised that all funds should be recovered within 24-48 hours. But let’s be real—many investors are still eyeing their wallets like a hawk, wondering if they’ll ever see their money again.

Read More

2025-08-04 22:46