Decentralized DeFi ecosystem projects Cream Finance and xToken are once again victims of a security exploit, losing nearly $30 million in total.
This Monday, the developers of the decentralized finance protocol (DeFi) Cream Finance reported via Twitter about an exploited vulnerability in the decentralized protocol, which caused the loss of more than $25 million in AMP and ETH tokens. According to the developers' report at the time of going to press, the Cream Finance attacker managed to mine 418.311.571 AMP tokens from Flexa Network, in addition to 1.308 ETH tokens from Ethereum. In total, losses in dollars amount to more than 25,6 million.
Cream Finance reported that the attacker found a security flaw in the AMP token contract and used a flash loan to extract funds from it. As a security measure, the developers stopped deposits and borrowing on the protocol; an action that did not go down well with some members of the crypto community who defend decentralization.
On the other hand, the DeFi protocol xToken also suffered a security vulnerability in which it lost about $4,5 million. On Twitter, the developers of this protocol reported that the xSNX contract was exploited, as was Cream Finance, using a flash loan to extract the funds. The developers published a report post mortem recognizing that the complexity of this product has opened a “significant surface area for vulnerabilities” in the DeFi protocol, so they have decided to close it.
It may interest you: DeFi hacks become popular and cause losses worth $474 million in 2021
Flash loan attacks
Flash loans are becoming one of the favorite tools of attackers operating in the decentralized finance ecosystem. The emergence of this type of loan in DeFi has made the risk within the ecosystem grow exponentially in the last year.
At the end of April, blockchain research and analysis firm Messari published a report on DeFi attacks that have occurred since 2019. In said report, the firm points out that 40% of the thefts to decentralized protocols had been carried out through flash loans. CipherTrace, another blockchain analysis firm, said in the middle of this month that attacks on DeFi are becoming popular and that value losses within this financial ecosystem exceed $474 million so far this year.
Second exploit so far this year
In the case of Cream Finance, as in xToken, the recent security flaws are the second exploits that these protocols suffer in 2021. Cream Finance was compromised in February of this same year, through a hack that involved the DeFi project Alpha Finance Lab. In this hack, the attacker managed to extract 37,5 million dollars from the protocol.
A month later, by mid-March, the DeFi protocol was also the victim of a DNS spoofing attack, which sought to scam protocol users by displaying a fake window within the Cream Finance website, to solicit confidential information from victims in an attempt to steal their private keys and funds. During this attack, the BSC decentralized protocol PancakeSwap was also a victim.
On the other hand, in the month of May xToken suffered a security vulnerability quite similar to the current one, in the xSNX contract. The developers reported about losses of 25 million dollars due to an exploit that occurred in the xSNXa and xBNTa contracts. By that time, researchers reported that the attacker executed a combined action to manipulate the market on the Kyber Network and exploit a bug in the xToken derivatives price oracles, allowing him to extract the funds.
DeFi Hacks
The recent attacks on Crem Finance and xToken come just weeks after the largest DeFi hack in history. The Poly Network protocol experienced two weeks of great uncertainty when an attacker managed to extract $613 million from its contract. Luckily, the developers reached an agreement with the hacker, who turned out to be a “White Hat Hacker,” and who returned the stolen funds a few days ago.
In addition to the recently exploited vulnerabilities in these DeFi protocols, the exchange Bilaxy also fell to the attack of hackers, who managed to breach their hot wallet ERC-20, withdrawing more than 290 ERC-20 tokens from the wallet, worth between $170.000 USD and several million dollars, according to unconfirmed reports at the time of going to press.
Continue reading: DeFi ecosystem loses another $7 million in recent The DAO Maker hack
