Audit log

Every state-changing event for CrediX Finance: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-26 19:54:21Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 422,351,456

   sig

   5KUU4hKq3sEM…4wsbkf3Xcopyexplorer ↗

   hash

   Eaiebf2hRiKe…48SDP71Gcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6739 B) ▸

   {"actor":"system:backfill","investigation_id":"294f90c2-a70f-4405-aedf-dd0bc7352bb5","kind":"publish","page_slug":"credix","published_at":"2026-05-26T19:54:21.320Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"CrediX Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/business/2025/08/04/defi-protocol-credix-taken-offline-after-usd4-5m-exploit","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/334313/credix-team-vanishes-stability-dao-preps-legal-report","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/markets/2023/07/26/crypto-lender-credix-brings-opens-private-credit-pool-on-solana-with-11-yield","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.quillaudits.com/blog/hack-analysis/credix-finance-4.5m-exploit","type":"other","url":""},{"credibility":3,"name":"https://quillaudits.medium.com/credix-finances-4-5m-exploit-96526a5119cc","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-credix-hack-august-2025","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2025/08/04/defi-protocol-credix-taken-offline-after-usd4-5m-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/365458/solana-lender-credix-defi-exploit","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/credix-finance-team-disappears-after-4-5m-hack","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/334313/credix-team-vanishes-stability-dao-preps-legal-report","type":"other","url":""},{"credibility":3,"name":"https://www.cryptotimes.io/2025/08/08/credix-team-suspectedly-pulls-off-exit-scam-after-4-5m-hack/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptopolitan.com/exit-scam-credix-disappears-after-a-4-5m-hack/","type":"other","url":""},{"credibility":3,"name":"https://www.newsbtc.com/news/exit-scam-defi-protocol-credixs-team-vanishes-following-4-5-million-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://decrypt.co/334313/credix-team-vanishes-stability-dao-preps-legal-report","type":"other","url":""},{"credibility":3,"name":"https://www.cointribune.com/en/credix-finance-disappears-4-5m-hack/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/credix-finance-team-disappears-after-4-5m-hack","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://skynet.certik.com/projects/credix","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-credix-hack-august-2025","type":"other","url":""},{"credibility":3,"name":"https://tokenvitals.com/blog/inside-credix-collapse-lessons-4-5m-defi-exit-scam","type":"other","url":""},{"credibility":3,"name":"https://www.quillaudits.com/blog/hack-analysis/credix-finance-4.5m-exploit","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.quillaudits.com/blog/hack-analysis/credix-finance-4.5m-exploit","type":"other","url":""},{"credibility":3,"name":"https://www.thearizonatribune.com/credix-hack-funds-washed-tornado-cash/","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2025/08/04/defi-protocol-credix-taken-offline-after-usd4-5m-exploit","type":"other","url":""},{"credibility":3,"name":"https://skynet.certik.com/projects/credix","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coingabbar.com/en/crypto-currency-news/credix-finance-scam-or-defi-rug-pull-plot-millions-vanish","type":"other","url":""},{"credibility":3,"name":"https://www.ainvest.com/news/credix-finance-team-suspected-exit-scam-4-5-million-hack-2508/","type":"other","url":""}]}],"sources_used":[],"summary":"CrediX Finance was a DeFi lending protocol launched in July 2025 on the Sonic blockchain that suffered a $4.5 million exploit on August 4, 2025, less than one month after launch. The exploit involved a compromised or insider-controlled admin wallet that minted unbacked synthetic tokens to drain liquidity pools; the team subsequently vanished, deleted all official channels, and failed to honor public recovery promises, prompting widespread allegations of a premeditated exit scam. Note: CrediX Finance (Sonic, 2025) is a distinct entity from Credix Finance (Solana, founded 2021), which is a separate legitimate RWA protocol.","timeline":[{"date":"2025-07-01","event":"CrediX Finance launches on the Sonic blockchain as a DeFi lending protocol, less than one month before the exploit.","source":""},{"date":"2025-07-29","event":"Attacker granted POOL_ADMIN_ROLE, BRIDGE_ROLE, ASSET_LISTING_ADMIN_ROLE, EMERGENCY_ADMIN_ROLE, and RISK_ADMIN_ROLE via the ACLManager contract by a CrediX admin EOA (0x0dd010513F7abB8F9c628dC164a24D953BCA09Cf). Transaction hash: 0x0cc3520951a2b41281dcc9a0d37ef3f7f139b75675d83ae72e3b8e903334f35e.","source":""},{"date":"2025-08-04","event":"Exploit executed at approximately 09:10 UTC. Attacker mints 2,500,000 unbacked acUSDC and 3,250,000 unbacked acscUSD, uses them as collateral to drain $4.5M in user funds. Protocol taken offline. Stolen assets bridged from Sonic to Ethereum via deBridge.","source":""},{"date":"2025-08-04","event":"CrediX Finance posts statement on X claiming 'All users funds will be recovered in full within 24-48 hours' and alleges a negotiated return deal with the exploiter.","source":""},{"date":"2025-08-05","event":"CertiK confirms stolen assets distributed across three Ethereum wallets. Approximately half (300 ETH) subsequently routed through Tornado Cash.","source":""},{"date":"2025-08-08","event":"CrediX Finance team goes completely dark. Website remains offline, X account deactivated, Telegram channel deleted, Discord shut down. No fund recovery occurs. CertiK publicly reports the disappearance.","source":""},{"date":"2025-08-08","event":"Stability DAO announces it is filing a formal legal report with cybercrime authorities, confirms KYC data for two CrediX team members has been obtained and will be submitted to law enforcement.","source":""},{"date":"2025-08-09","event":"Multiple affected protocols — Sonic Labs, Euler, Beets, Trevee — join Stability DAO's coordinated legal and recovery effort. Trevee reduces its CrediX exposure from $1.6M to approximately $700K.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ede1cc6d-bd3a-4159-978b-2524ce1a62decopy
2. #2rescoreby systemsystem

   2026-10-27 06:02:59Z
   Score: 4 → 0 (-4)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 4 → 0. The page establishes that the subject is itself a scheme, so the score is 0.
   anchoranchored

   chain

   ●mainnet-betaslot 461,962,389

   sig

   333Yy41Qk2rk…HFM3jh8Tcopyexplorer ↗

   hash

   7SNScZEZaN8L…dPiXqVEkcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (512 B) ▸

   {"actor":"system","decided_at":"2026-10-27T06:02:59.948Z","decision":"rescore","investigation_id":"294f90c2-a70f-4405-aedf-dd0bc7352bb5","new_score":0,"page_slug":"credix","prev_score":4,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 4 → 0. The page establishes that the subject is itself a scheme, so the score is 0.","score_delta":-4,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 325661d6-9cc5-485a-801a-30db21502a2bcopy
3. #3reviewby reviewerreviewer

   2026-11-04 01:09:13Z
   Score: 0 → 0 (no score change)
   The core narrative is well supported by QuillAudits, Decrypt and search results. It covers the roughly $4.5M exploit on Aug 4, 2025, the five admin roles granted via ACLManager, the unbacked mints, the team disappearing, and Stability DAO's legal report. A few specifics were not found in the sources checked: the 09:10 UTC time, the 630 ETH remaining, and the Euler, Beets and Trevee details. The page handles the Solana Credix name confusion carefully and hedges the unverified ZachXBT flag. The review was time-limited and only two cited sources were fetched in full.
   anchoranchored

   chain

   ●mainnet-betaslot 465,111,697

   sig

   5VvxNg1SL4Th…UA14xqbAcopyexplorer ↗

   hash

   WLHbLoQovkYP…gu9fkMnncopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1373 B) ▸

   {"actor":"reviewer","artifact_identity":"d371d947ef4f43fc62a74a994206cbcd","decided_at":"2026-11-04T01:09:13.624Z","decision":"review","disputed_pct":0.4,"findings_hash":"w6DbAT2Z4TGeW1tWxHueppiHYkE5kbYyD1k77WPxXjb","investigation_id":"294f90c2-a70f-4405-aedf-dd0bc7352bb5","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":0,"page_content_hash":"7eaf7407bd401a00dff633535a834a8b0e443e837bece604bd07938ecbc102be","page_slug":"credix","prev_score":0,"reason":"The core narrative is well supported by QuillAudits, Decrypt and search results. It covers the roughly $4.5M exploit on Aug 4, 2025, the five admin roles granted via ACLManager, the unbacked mints, the team disappearing, and Stability DAO's legal report. A few specifics were not found in the sources checked: the 09:10 UTC time, the 630 ETH remaining, and the Euler, Beets and Trevee details. The page handles the Solana Credix name confusion carefully and hedges the unverified ZachXBT flag. The review was time-limited and only two cited sources were fetched in full.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":3,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision dcd24916-caa1-4005-8b2c-e54ad11bc793copy
4. #4review reviseby judgejudge

   2026-11-04 01:09:13Z
   Score: 0 → 0 (no score change)
   Two of the five reviewed claims (claim_findings[1], the 09:10 UTC time, and claim_findings[2], the 630 ETH remaining in attacker wallets) could not be found in the sources the reviewer fetched, which puts the unverified share at 40%. No claim was disputed. The core account (five admin roles, unbacked mints, the team vanishing, Stability DAO's legal report) was confirmed (claim_findings[0], [4]), and the page's account of the shutdown matches the reviewer's status check. Because the unverified items are secondary details and the reviewer's confidence is limited, the penalty is set at the mild end of the band.
   anchoranchored

   chain

   ●mainnet-betaslot 465,111,702

   sig

   CiC6TAidCiZv…t4uxCvCrcopyexplorer ↗

   hash

   9AZyHkPvTP5b…aMDUzCz3copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1250 B) ▸

   {"actor":"judge","artifact_identity":"d371d947ef4f43fc62a74a994206cbcd","band_override":null,"decided_at":"2026-11-04T01:09:13.624Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.4,"investigation_id":"294f90c2-a70f-4405-aedf-dd0bc7352bb5","judge_def_hash":"750934ecb48272224909b7430fab271676d391380fbc821acbe7ee7e4cac2fa3","new_score":0,"page_slug":"credix","prev_score":0,"reason":"Two of the five reviewed claims (claim_findings[1], the 09:10 UTC time, and claim_findings[2], the 630 ETH remaining in attacker wallets) could not be found in the sources the reviewer fetched, which puts the unverified share at 40%. No claim was disputed. The core account (five admin roles, unbacked mints, the team vanishing, Stability DAO's legal report) was confirmed (claim_findings[0], [4]), and the page's account of the shutdown matches the reviewer's status check. Because the unverified items are secondary details and the reviewer's confidence is limited, the penalty is set at the mild end of the band.","reviewer_def_hash":"3839668b232611e5b26db72079d64745f8e57e919b8a379e79b44ba4a52c845b","score_delta":0,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 4936b056-997a-4863-a905-8c721998fa4ecopy