Cream Finance, a decentralized lending protocol built on the Ethereum blockchain, was hacked yesterday, losing $130 million.
The developers of Cream Finance, a decentralized finance protocol (DeFi) focused on loans, has lost another $130 million in the third exploit it suffers in 2021. So far this year, Cream Finance has been the victim of 3 flash loan attacks, totaling losses worth $186 million. dollars.
The attack on Cream Finance was reported by PeckShield, a cybersecurity and analytics company blockchain, and confirmed a few hours later by the protocol developers. Through Twitter, Cream Finance reported that its loan market on the blockchain Ethereum, CREAM v1, were exploited by a hacker, who managed to extract the liquidity of the contract this Wednesday the 27th in the afternoon. “The attacker mined a total of ~$130 million in tokens from this market”, explained the protocol, revealing the address used by the hacker.
According to data from Etherscan, funds were drawn from the protocol using nearly 70 Cream Finance liquidity tokens, such as DAI, yUSDT and yUSDC, and others ERC-20 tokens of the Ethereum network.
At the time of writing, the Cream Finance development team has not provided further details about the exploit. However, reported that the protocol liquidity markets on Ethereum were stopped and that they are collaborating with the Yearn Finance development team to patch the vulnerability present in the code. Cream Finance is expected to publish a report in the next few hours postmortem about the exploit that happened.
It may interest you: Cream Finance wants to strengthen its security, and offers a $1,5 million rewards program
More than $180 million so far this year
El web portal Cryptosec, which tracks hacks and exploits that have occurred within the DeFi ecosystem in general, notes that Cream Finance has lost a total of $186 million this year, as a result of flash loan attacks.
In February, the DeFi protocol lost $37 million in a combined attack that allowed the hacker to trick the protocol using a fake Alpha Homora contract and a flash loan. On August 30, Cream Finance suffered losses of $18,8 million due to a re-entry error introduced by the Amp (AMP) token, research by Peckshield revealed.
In March, the protocol also suffered a phishing attack, which sought to trick users into handing over their private keys y phrases seeds to the attackers.
The 4th largest DeFi hack
The Cryptosec portal's classification places the recent Cream Finance exploit as the fourth largest to occur in DeFi in the last year. According to the platform's ranking, the exploit suffered poly network It is the largest seen so far. In August, Poly Network experienced one of the toughest moments in DeFi history, the result of a hack that robbed it of $610 million; although a few weeks later the hacker ended up returning all of the stolen funds.
The second largest DeFi exploit recorded so far is that of pancakebunny, which lost $200 million as a result of a major vulnerability in its code in May. Paid Network suffered the third largest hack on record in DeFi, with a loss of $160 million. The attacker of this protocol managed to exploit a vulnerability that allowed him to mint and mine PAID tokens for the aforementioned value.
Other DeFi protocols, such as EasyFi, Uranium Finance y Belt Finance They also suffered exploits for quite considerable sums. EasyFi lost $80 million from a vulnerability exploited in April, while Uranium Finance and Belt Finance each lost $50 million from hacks in April and May, respectively.
CREAM value falls 36%
At press time, the value of the CREAM token has fallen by 36%. As CoinGecko data shows, CREAM is trading below $100 per token.
On the other hand, the liquidity of the protocol in the Ethereum DeFi ecosystem has decreased by more than 20% in the last few hours. DeFi data provider Llama shows that the total value locked in Cream Finance is 1.320 million at the moment. Yesterday, the liquidity deposited within these protocols exceeds 1.700 billion dollars.
Continue reading: Cream Finance and PancakeSwap were victims of a DNS spoofing attack
