CrediX recovered $4.5 million in stolen crypto after reaching a deal with the exploiter. Affected users will be refunded within 48 hours, the team said.
News
Money market abstraction infrastructure protocol CrediX has successfully negotiated the return of the assets stolen in a $4.5 million exploit, in a promising sign for users looking to recover their cryptocurrency.
CrediX suffered a security breach on Monday that saw over $4.5 million worth of digital assets bridged to the Ethereum network by a Tornado Cash-funded wallet, to blockchain security firm Cyvers.
In a surprising development, CrediX it reached a private settlement with the attacker, who agreed to return the stolen assets in exchange for an undisclosed payment from the CrediX treasury. “Reached successful parley with the exploiter who agreed to return the funds within the next 24-48 hours in return for money fully paid by the credix treasury,” CrediX said on X.
The protocol plans to airdrop the recovered funds to the addresses of all affected users within the next 48 hours, it added.
Cointelegraph has reached out to Credix for further comment on the negotiation details and whether the return qualifies as a white hat bounty.
Related:
Cryptocurrency hacks have surged in 2025, but some attackers are choosing to return stolen assets in exchange for negotiated settlements or bounties. On July 11, another stolen from the GMX exploit in exchange for a $5 million white hat bounty offered by the team.
In May 2024, another stolen from a , giving in to the mounting pressure from blockchain investigators worldwide.
The return of the funds came shortly after onchain security firm published an analysis on the attacker’s potential Hong Kong-based IPs, suggesting that the thief was concerned about the implications.
Related:
Signaling a growing need for better cybersecurity solutions, cryptocurrency hacks, exploits and scams , with over $800 million lost across 144 incidents in Q2, a 52% decrease from Q1, CertiK in a report on June 30.
Nearly in price after a hack or exploit, according to a report by onchain security firm Immunefi. This devaluation often causes more damage to projects than the exploit itself.
However, hackers are also targeting traditional banking infrastructure. On July 5, C&M Software, the service provider that connects Brazil’s Central Bank to local banks and other financial institutions, was across six connected institutions, Cointelegraph reported.
The hack occurred due to a C&M employee allegedly selling his login credentials to the exploiter for about $2,700, enabling them to access the banking system and its reserve accounts, local media outlets reported.
