CrediX Hacker Returns $4.5M After 6-Day Heist – DeFi Negotiation Trend Emerges

The hacker responsible for the $4.5 million exploit of the CrediX DeFi protocol has agreed to return the stolen funds within 24 to 48 hours following successful negotiations. CrediX confirmed the agreement on social media, noting the exploiter will receive compensation from the protocol's treasury, while affected users will be reimbursed via airdrops.

The resolution comes after a six-day breach where attackers gained control of CrediX’s multisig wallet, exploiting bridge privileges to mint unbacked collateral tokens on the Sonic network. Tornado Cash-funded addresses were used to manipulate BRIDGE role permissions, minting acUSDC tokens and draining $2.64 million from lending pools.

CrediX joins a growing list of DeFi protocols in 2025 recovering funds through negotiation, including GMX’s $40.5 million settlement. This trend highlights a shift in how the DeFi ecosystem handles exploits, balancing security vulnerabilities with pragmatic resolutions.