Money market abstraction infrastructure protocol CrediX has successfully negotiated the return of the assets stolen in a $4.5 million exploit, in a promising sign for users looking to recover their cryptocurrency.

CrediX suffered a security breach on Monday that saw over $4.5 million worth of digital assets bridged to the Ethereum network by a Tornado Cash-funded wallet, according to blockchain security firm Cyvers.

In a surprising development, CrediX said it reached a private settlement with the attacker, who agreed to return the stolen assets in exchange for an undisclosed payment from the CrediX treasury. “Reached successful parley with the exploiter who agreed to return the funds within the next 24-48 hours in return for money fully paid by the credix treasury,” CrediX said on X.

The protocol plans to airdrop the recovered funds to the addresses of all affected users within the next 48 hours, it added.

Cointelegraph has reached out to Credix for further comment on the negotiation details and whether the return qualifies as a white hat bounty.

Related: White hat ‘SEAL’ team protecting from crypto hacks surpasses 900 investigations

Cryptocurrency hacks have surged in 2025, but some attackers are choosing to return stolen assets in exchange for negotiated settlements or bounties. On July 11, another exploiter returned $40 million stolen from the GMX exploit in exchange for a $5 million white hat bounty offered by the team.

In May 2024, another thief returned $71 million stolen from a wallet poisoning scam, giving in to the mounting pressure from blockchain investigators worldwide.

The return of the funds came shortly after onchain security firm SlowMist published an analysis on the attacker’s potential Hong Kong-based IPs, suggesting that the thief was concerned about the implications.

Related: Top 100 DeFi Hacks: Offchain attack vectors account for 57% of losses

Crypto exploits surpass $2.5 billion in 2025

Signaling a growing need for better cybersecurity solutions, cryptocurrency hacks, exploits and scams spiked to $2.47 billion in the first half of 2025, with over $800 million lost across 144 incidents in Q2, a 52% decrease from Q1, CertiK said in a report on June 30.

Nearly 80% of cryptocurrencies never recover in price after a hack or exploit, according to a report by onchain security firm Immunefi. This devaluation often causes more damage to projects than the exploit itself.

However, hackers are also targeting traditional banking infrastructure. On July 5, C&M Software, the service provider that connects Brazil’s Central Bank to local banks and other financial institutions, was hacked for $140 million across six connected institutions, Cointelegraph reported.

The hack occurred due to a C&M employee allegedly selling his login credentials to the exploiter for about $2,700, enabling them to access the banking system and its reserve accounts, local media outlets reported.

Magazine: Coinbase hack shows the law probably won’t protect you — Here’s why