CrediX lost $4.5 million in a hack attack on Monday, August 4. Hours after confirming the development, the decentralized finance protocol eased the woes of its community, informing that they have negotiated with the hacker to recover the stolen amount.
In a post on X, the Switzerland-headquartered company said the lost user funds will likely be recovered within the next 24 to 48 hours. In return, the hacker has asked CrediX to bear the cost of having the $4.5 million swiped in the attack returned.
“We have addresses of all the affected users and will airdrop them their share of assets in the respective timeframe,” shared the official company handle on X, that goes by the username @CrediX_fi.
On-chain security firm CertiK was among the first entities to have raised a flag against a security breach incident targeting CrediX on Monday.
“All the funds were bridged from Sonic to Ethereum network,” CertiK had noted, while claiming that the attacker had split the stolen amount into three separate wallets.
While CrediX is yet to share how the attack happened, Web3 analysts have indicated that the compromise of private keys could have led to the exploit.
“The CrediX multisig wallet, six days ago, added an attacker as both Admin and Bridge via ACLManager. This enabled the attacker, acting in the Bridge role, to directly mint collateral tokens for themselves through the pool. Through this, the attacker borrowed a large amount of assets, draining the pool,” Justin Wu, a former member of the Pi Network team said on X, sharing proofs to back his claims.
Meanwhile, blockchain security firm PeckShield has said that an admin attack was compromised that resulted in the successful deployment of this incident.
After CrediX acknowledged having suffered this attack, it told its users that the platform’s website was being disabled to prevent users from processing deposits. The platform had suggested users to use contracts to facilitate withdrawals.
As of now, the company has not revealed any details on the hacker or how the negotiations started. The pay demand that the hacker has extended also remains undisclosed by CrediX for now.
As per CertiK, crypto hacks and scams led to losses worth $153 million in the month of July alone.
“$86.6 million is attributed to incidents involving exchanges. Incidents related to code vulnerabilities represent $55.4 million losses,” it claimed.
Last month, the hacks of India’s CoinDCX and Taiwan’s Woo X exchange made for prominent cases.