Sign in Subscribe
Vulnerabilities

$4.5M DeFi Heist: Admin Access Turned Into a Money Printer

$4.5M DeFi Heist: Admin Access Turned Into a Money Printer

Source: Credix REKT

In a shocking breach, an attacker with compromised admin access exploited bridge privileges to siphon $4.5 million from Credix’s DeFi protocol. Rather than exploiting bugs or breaking code, the attacker leveraged their full administrative control to mint unbacked acUSDC tokens and drain liquidity pools. This incident exposes a harsh truth: sometimes the biggest risks in DeFi aren’t technical flaws, but trusted insiders or mismanaged privileged access.

How the Attack Unfolded: Keys to the Kingdom Misused

This was not a hack, but an administrative betrayal cloaked in “security breach” language.
  • Six days before the heist, an admin account was granted critical roles including POOL_ADMIN, BRIDGE, ASSET_LISTING_ADMIN, EMERGENCY_ADMIN, and RISK_ADMIN - putting the attacker in full control.
  • Using the BRIDGE role, the attacker minted fake acUSDC tokens out of thin air.
  • These phantom tokens were then used as collateral to borrow real assets valued at $4.5 million.
  • The protocol’s lending system failed to detect this fake collateral, approving loans against tokens created solely during the attacker’s bridge transactions.
  • No smart contract vulnerabilities or leaked private keys were involved - the attacker simply abused valid permissions.

The Attack Timeline and Fund Movements

  • The attacker secured admin privileges six days before the funds were drained.
  • Multiple suspicious transactions were tracked, with funds moved through several Ethereum wallets.
  • The stolen assets were laundered using cross-chain bridges like deBridge, allowing the attacker to shift liquidity across chains seamlessly.
  • By the time alerts rang, the hacker had already consolidated the funds on Ethereum, leaving Credix scrambling to understand the losses.

Credix’s Response and Recovery Promise

  • Shortly after confirming the hack, Credix promised full recovery of user funds within 24-48 hours, but provided no details on reserves or recovery methods.
  • Users were advised to withdraw directly from contracts, signaling a loss of frontend control.
  • Later, Credix announced a supposed deal with the attacker, agreeing to return funds in exchange for the exploiter keeping a portion - though specific terms remain undisclosed.
  • Despite the fast recovery timeline, the fundamental question remains: How was the admin access granted and left unsupervised for nearly a week?

Key Lessons: The Real Culprit Is Privileged Access

  • The Credix attack highlights the danger of mismanaged admin keys and unchecked bridge permissions.
  • Smart contracts and code audits aren't enough; protocols must rigorously monitor and secure human access and governance roles.
  • The blockchain records every transaction but not the moment trust is breached; the attack was essentially an insider turning a protocol’s own power into a personal money printer.
  • Protocols must rethink trust models to prevent administrators from becoming the largest single point of failure.

Conclusion: Trust but Verify - Always

Credix’s case serves as a stark warning: as DeFi grows, the greatest vulnerabilities often come not from external hackers but from those entrusted with control. No amount of technical excellence will protect a protocol if admin privileges are mismanaged. The blockchain enshrines transparency - every transaction is visible - but that transparency cannot shield protocols from betrayal when governance fails.

Read next