What happened
On August 4, 2025, CrediX on Sonic was drained of approximately $4.5 million after an attacker used an administrative account to mint unbacked stablecoins and withdraw assets users had posted as collateral. Reporting says the account received special privileges six days earlier and that the proceeds were bridged from Sonic to Ethereum. CrediX promised full recovery within two days, but the opened report does not establish the final outcome.
How it happened
- An administrative account received special privileges six days before the drain.
- The attacker used that access to mint unbacked stablecoins.
- The minted assets were used to withdraw collateral that users had posted to CrediX.
- The reported proceeds were bridged from Sonic to Ethereum.
Protocol details
Classification
Infrastructure / Exchange (DEX) / Key Compromise
Protocol Type
RWA Lending
Implementation language
Solidity
Protocol links
Website
@CrediX_fi
Security review history
- CertiK View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
