Cream Finance Suffers Another Exploit as Attacker Runs Away With USD 100M+

Crime DeFi Hack

Author

Linas Kmieliauskas

Author

Linas Kmieliauskas

Author Profile

Share

Copied

Last updated:

October 23, 2023 09:29 EDT

Why Trust Cryptonews

Cryptonews has covered the cryptocurrency industry topics since 2017, aiming to provide informative insights to our readers. Our journalists and analysts have extensive experience in market analysis and blockchain technologies. We strive to maintain high editorial standards, focusing on factual accuracy and balanced reporting across all areas - from cryptocurrencies and blockchain projects to industry events, products, and technological developments. Our ongoing presence in the industry reflects our commitment to delivering relevant information in the evolving world of digital assets. Read more about Cryptonews

Ad Disclosure

We believe in full transparency with our readers. Some of our content includes affiliate links, and we may earn a commission through these partnerships.

Ethereum (ETH)-powered decentralized finance (DeFi) project Cream Finance (CREAM) suffered another flash loan attack as the attacker reportedly stole more than USD 100m worth of tokens.

Blockchain analytics and security firm PeckShield flagged the attacker’s address, while Cream finance confirmed that they “are investigating an exploit on C.R.E.A.M. v1 on Ethereum and will share updates as soon as they are available.”

CREAM tanked following the news and, at 15:11 UTC, it trades at USD 111.61, dropping by almost 30% in an hour and a day.

“The hack is made possible due to a price manipulation bug in CREAM price oracle,” PeckShield said, adding that the hacker is still swapping the stolen funds via ParaSwap and Uniswap platforms.

Just this past August, Cream Finance lost USD 25m in another flash loan attack.
___

 

Reactions:
 

How about not using $CREAM @CreamdotFinance at all.
First exploit, it's okay, mistakes happen, and can easily come back from it. Second exploit, uh buddy, didn't you learn the first time?
Third exploit, severe incompetence, do not use Cream.

— Skinnvesten (💙,🧡) (@Skinnvaesten) October 27, 2021

Well the devs should come out with an IRS and SEC threat before that

— thesnakecharmer☀ (@snakecharmerXBT) October 27, 2021

___
Learn more: 
– Vee Finance Reports an USD 36M Exploit, VEE Takes a Dive
– SushiSwap’s MISO Suffers USD 3M Attack, Contract Thefts May Rise

– Tether Frozen in Poly Hack Returned to Owners, Fuelling Centralization Debate
– Two More Binance Smart Chain Projects Report Incidents, Prices Plummet
___
(Updated at 16:55 UTC with additional comments from PeckShield.)