Cream Finance Exploited in Flash Loan Attack Netting Over $100M

An attacker has gained over $130 million of assets in an exploit that appears to have drained Cream’s coffers.

AccessTimeIconOct 27, 2021 at 2:57 p.m. UTC
Updated Dec 22, 2021 at 6:07 p.m. UTC

Andrew Thurman was a tech reporter at CoinDesk with a focus on DeFi.

Decentralized finance (DeFi) money market and lending service C.R.E.A.M. Finance appears to have been the target of a devastating exploit Wednesday morning that drained over $260 billion in funds, likely the second-largest exploit to date.

According to Cream’s native front end, most Ethereum-based pools are now empty with the exception of a $40 million $CREAM pool. As of Oct 23, the protocol’s Ethereum markets had $300 million worth of assets.

Cream’s official Twitter account acknowledged the attack in a Tweet:

Per DeFi Llama, the protocol has an additional $460 million in total value locked (TVL) across Binance Smart Chain, Polygon, Avalanche and Fantom. It is unclear if those funds are also at risk.

The funds appear to have been taken using a flash loan in a notably complex transaction that involved 68 different assets and cost over 9 ETH in gas. Of the $260 million lost, the attacker netted roughly $130 million in various cryptocurrencies, of which $40.6 million may be in illiquid crETH, a staked ETH derivative that may prove difficult for the attacker to sell.

The attacker is now working to “wash” the funds primarily using Ren’s Bitcoin bridge. As is often the case following exploits, individuals are now using Ethereum transactions to ask for donations.

A Cream representative did not respond to a request for comment by press time.

UPDATE (Oct. 27 16:07 UTC): Added TVL information, market size information, and new developments from attacker’s Ethereum address. Removed reference to Curve’s 3Pool as a mixer.


Read more about

DISCLOSURE

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

CoinDesk - Unknown

Andrew Thurman was a tech reporter at CoinDesk with a focus on DeFi.

CoinDesk - Unknown

Andrew Thurman was a tech reporter at CoinDesk with a focus on DeFi.

Trending

1
CoinDesk - Unknown
CoinShares Completes Napoleon Acquisition, Can Now Offer Products Across EU

The acquisition of Napoleon Asset Management was subject to approval by the AMF, which was granted on June 28.

CoinDesk - Unknown
2
CoinDesk - Unknown
Coinbase Says Miners’ Sales of Newly Minted Bitcoins Don’t Add Significant Market Pressure

If all newly issued bitcoin were immediately sold onto the market each day, it would equate to only 900 BTC of selling pressure, the report said.

CoinDesk - Unknown
3
CoinDesk - Unknown
WonderFi Closes Acquisition of Crypto Trading Platform Coinberry

The Canadian crypto firm says it's open to more deals for firms hit by the crypto winter.

CoinDesk - Unknown
4
CoinDesk - Unknown
Crypto Lender Celsius Cuts 150 Jobs Amid Restructuring: Report

Withdrawals are still paused and the company has hired restructuring experts as it faces a financial crisis.

CoinDesk - Unknown