On August 4, 2025, CrediX on Sonic suffered $4.5M loss when attacker gained admin access via ACLManager, minting unbacked acUSDC and draining pools. Funds were moved to Ethereum via Tornado Cash. The team vanished August 8.

The decentralized lending protocol Credix suffered an exploit, losing approximately $4.5 million. The attacker gained control of an admin wallet, minted tokens, and drained liquidity pools. After the incident, Credix claimed it had reached a settlement with the attacker, who agreed to return the funds on the condition that “a certain amount would be fully paid by the Credix treasury.” However, Credix did not disclose how much was actually paid. Shortly after this announcement, Credix deleted its social media accounts and the team disappeared, sparking speculation that the so-called “hack” may in fact have been a rug pull orchestrated by insiders. To date, the promised reimbursements have not been fulfilled.