CrediX DeFi Protocol Exploited as Hacker Gains Admin Rights, Drains Pool

Key Points

1. Attackers exploited the BRIDGE role to mint acUSDC tokens, draining approximately $2.64 million from CrediX's lending pools.

2. The attacker's address held extensive privileges, including POOL_ADMIN, BRIDGE, ASSET_LISTING_ADMIN, EMERGENCY_ADMIN, and RISK_ADMIN roles.

3. The CrediX breach follows a pattern seen in major crypto hacks, such as the $234 million WazirX breach in July 2024, involving legitimate-appearing transactions from authorized accounts.

4. July 2025 saw $142 million in crypto losses across 17 major incidents, including a $44 million insider breach at CoinDCX and a $42 million exploit at GMX.

5. Crypto investors lost over $2.2 billion in the first half of 2025 through 344 incidents, with wallet-related breaches accounting for $1.7 billion and phishing scams stealing $410 million.