CrediX team vanishes after $4.5 million
🧨 What Happened
- Exploit Date: August 4, 2025
- Amount Lost: $4.5 million
- Method: Attackers gained access to CrediX’s admin wallet and bridge permissions, allowing them to mint unbacked tokens and drain liquidity pools.
- Blockchain Movement: Funds were moved from the Sonic blockchain to Ethereum and distributed across multiple wallets.
🕵️♂️ Suspicious Behavior
- Initial Response: CrediX acknowledged the breach and promised to reimburse affected users within 24–48 hours.
- Sudden Silence: Shortly after, the team went dark:
- Website taken offline
- X (formerly Twitter) account deactivated
- Telegram channel deleted
- No Recovery Plan: No further updates or reimbursements have been issued.
🚨 Exit Scam Concerns
- Rug Pull Indicators:
- Disappearance of communication channels
- No follow-through on reimbursement promises
- Movement of stolen funds through Tornado Cash and private wallets
- Similar Cases: Echoes past DeFi scams like DF Fintoch ($32M) and Swamprum DEX ($3M).
🛡️ Community & Legal Response
- Stability DAO:
- Identified two CrediX team members via KYC
- Preparing a legal report
- Coordinating with affected projects and authorities to recover funds
- Impacted Projects: Sonic Labs, Euler, Beets, Trevee, and others are collaborating on the investigation.
⚠️ Why It Matters
This incident highlights ongoing vulnerabilities in DeFi:
- Lack of regulatory oversight
- High risk of insider abuse
- Difficulty in tracing and recovering stolen assets
It’s a stark reminder for investors to prioritize transparency, audit history, and community trust when engaging with DeFi platforms.
