CrediX Hacker Agrees to Return $4.5 Million After Successful Negotiations

The hacker responsible for the $4.5 million breach of CrediX Finance has reached an agreement to return the stolen money after successful negotiations. CrediX expects the funds to be returned within 24 to 48 hours. This incident highlights ongoing security concerns within DeFi protocols.

Key Takeaways

The hacker involved in the CrediX Finance exploit has agreed to return $4.5 million.
The return is expected to occur within 24 to 48 hours after negotiations.
An undisclosed amount from CrediX’s treasury is included in the agreement.
CrediX plans to reimburse affected users by airdropping shares of the returned funds.
The incident reflects ongoing security vulnerabilities in DeFi protocols.

CrediX hacker agrees to return $4.5m after successful negotiations

Successful Negotiation Leads to Expected Fund Return

The individual behind the $4.5 million exploit on CrediX Finance has agreed to return the stolen funds following a successful resolution. In an update shared late Monday, CrediX announced that an agreement had been reached with the hacker who drained the funds from its platform, and they anticipate the return of the stolen assets within the next 24 to 48 hours.

The agreement includes an undisclosed payment from CrediX’s treasury, which will be made to the hacker in exchange for the safe return of the stolen funds. The terms do not mention any legal actions or further conditions.

CrediX expressed optimism about the situation, stating, “We have good news for our users. We reached a successful parley with the exploiter who agreed to return the funds within the next 24-48 hours in return for money fully paid by the CrediX treasury.”

Once the funds are received, CrediX plans to reimburse the impacted users. They have announced that they will distribute the returned assets via an airdrop to ensure full recovery of the losses caused by the hack.

Background of the Attack

The breach at CrediX occurred less than a month after the platform was launched, offering a lending solution for real-world assets that allows borrowers to secure loans backed by off-chain income and collateral from DeFi lenders.

Security firm SlowMist reported that the hacking began nearly a week prior to the exploit when the attackers gained unauthorized access to both the multisig admin and bridge wallets of the protocol. With control over essential systems, the hackers minted collateral tokens, borrowed against the protocol, and quickly drained its liquidity. After the theft, the stolen assets were transferred from Sonic to Ethereum.

Ongoing DeFi Security Concerns

The CrediX incident adds to a growing list of exploits targeting DeFi protocols this year. In July alone, over $153 million was lost to crypto hacks and scams, bringing the total losses across the industry in 2025 to more than $3.1 billion.

Another recent target, GMX, was hacked for $42 million on July 9; however, they also successfully recovered the stolen funds the following month by offering a 10% bounty to the hacker.

Despite these successful recoveries, the trend of frequent attacks indicates a persistent problem. Although labeled as decentralized, many DeFi protocols still depend on centralized controls like admin keys, upgradable contracts, and emergency pause functions. These features have become common points of entry for attackers, highlighting the need for stronger security measures and improved defenses.

As of now, CrediX has yet to confirm the receipt of the funds, and it remains uncertain whether the hacker will honor their agreement.