DeFi Security Crisis: Multisig Wallet Exploits Push 2025 Losses to $3.1 Billion

The decentralized finance ecosystem has entered one of its most critical periods in history, as a series of exploits continues to expose the weaknesses of multisig wallets and governance protocols. The latest victim, CrediX, suffered a $4.5 million loss following a sophisticated attack that granted the hacker administrative privileges and bridge access to its pools. This incident adds to the staggering $3.1 billion in DeFi losses already recorded in 2025, further highlighting the urgent need for improved wallet and protocol security.

Security analysts warn that these repeated attacks, largely targeting multisig configurations, are pushing DeFi toward a crisis of trust. With high-profile breaches occurring almost monthly, the industry is being forced to rethink access control, governance automation, and real-time threat monitoring.

How the CrediX Hack Unfolded

The CrediX breach began with the attacker securing privileged access to the project’s multisig wallet through its ACLManager, a tool designed to assign specific roles. Six days before the exploit, the attacker was granted both Admin and Bridge roles. This combination allowed them to mint collateral tokens in the CrediX Pool, borrow assets against the fabricated collateral, and drain the protocol without triggering standard defenses.

Blockchain security firm SlowMist confirmed that the attacker strategically bridged the stolen funds from Sonic to Ethereum, masking movements through multiple transactions. Cyvers Alerts, another Web3 security platform, traced the activity to an address funded via Tornado Cash, a known privacy mixer, which was then used to initiate the exploit on Sonic before bridging to Ethereum.

The method employed highlights a familiar pattern in 2025’s DeFi exploits: a combination of internal access manipulation, multisig mismanagement, and cross-chain bridge vulnerabilities. Unlike traditional smart contract hacks, this type of incident reflects the growing threat of governance-level compromises.

The Rising Threat of Multisig Wallets

Multisig wallets were once hailed as a cornerstone of DeFi security, offering an additional layer of protection by requiring multiple signers to authorize transactions. However, the events of 2025 demonstrate that multisig alone is no longer sufficient.

According to Hacken, more than 80% of this year’s crypto losses have stemmed from access control failures in multisig environments. Common vulnerabilities include:

1. Social Engineering Attacks – Signers tricked through fake UIs or phishing campaigns.
2. Misconfigured Signer Setups – Poor distribution of keys increases single-point-of-failure risk.
3. Privileged Role Mismanagement – Assigning bridge or admin rights without automated monitoring.

The largest exploit of the year—valued at $1.46 billion—was a Bybit multisig breach where attackers used a spoofed interface to gain signer approvals. The CrediX incident is a smaller-scale but equally concerning example of how human and structural weaknesses in multisig governance can result in catastrophic losses.

Why 2025 Is a Critical Year for DeFi Security

As of mid-2025, total DeFi losses have already exceeded $3.1 billion, placing this year among the worst on record. Experts cite several reasons for the growing risk:

• Complexity of Cross-Chain Bridges – Moving assets across chains introduces multiple attack surfaces.
• Underestimation of Insider Threats – Protocols often focus on smart contract audits while neglecting operational security.
• Overreliance on One-Time Audits – Static checks fail to detect dynamic attacks unfolding over days or weeks.

The CrediX attack illustrates how these weaknesses intersect. The attacker had days of unrestricted access, likely testing the system before executing the final drain. By the time the exploit became visible on-chain, funds were already bridged out, and the website was forced offline to prevent further deposits.

The Push for Real-Time Threat Detection

In response to the surge in multisig exploits, Hacken and other security firms are now urging the industry to abandon traditional security practices in favor of continuous, AI-driven monitoring.

Key recommendations include:

• Real-Time Multisig Monitoring – Tracking unusual signer activity or privilege escalations as they happen.
• Rule-Based Automation – Preventing high-risk transactions or role changes without secondary verification.
• Signer Training and Compartmentalization – Reducing the human element in critical approvals.

Hacken’s latest report emphasizes that timely detection can reduce losses by over 70%, turning many catastrophic drains into containable incidents.

DeFi Market Confidence Under Pressure

Beyond the technical implications, incidents like the CrediX hack threaten DeFi’s credibility. Retail and institutional investors are becoming increasingly wary of platforms with limited security transparency. In a market that relies heavily on user trust, repeated breaches risk slowing adoption and triggering prolonged liquidity outflows.

Protocols that prioritize security-first governance, implement real-time threat detection, and embrace multi-layered risk mitigation are likely to outperform in the long term. Meanwhile, projects that rely on outdated multisig practices and single-event audits remain prime targets for attackers.

A Pivotal Moment for DeFi Security

The CrediX exploit is not just another isolated incident—it represents the growing pains of a sector racing toward maturity. With $3.1 billion in losses already logged this year, 2025 is proving to be a wake-up call for decentralized finance.

If DeFi is to regain trust and sustain its growth trajectory, protocols must pivot toward proactive, continuous security measures that protect both funds and reputations. The next wave of innovation will belong not to the platforms offering the highest yields, but to those that demonstrate uncompromising security and operational transparency.