Cream Finance Hacked for $130 Million In Another Flash Loan Attack

Decentralized lending protocol Cream Finance has suffered a flash loan attack, losing over $130 million worth of various crypto assets. This was the third successful hack against the popular DeFi project in the past year.

• Cream Finance has confirmed it suffered an exploit this Wednesday through a flash loan attack, compromising mostly Cream LP tokens and other ERC-20 coins.
• Blockchain security firm PeckShield was the first to identify the attack. Data from blockchain explorer Etherscan shows $132 million was stolen from the C.R.E.A.M v1 marketplace on Ethereum, later sent to two different wallets.
• The flash loan involved 68 different assets and cost around 9 ETH in gas. At press time, the attacker now holds $92 million worth of various tokens on its contract, and $22 million are held by the contract creator’s address.

#FlashLoanAlert https://t.co/XzAvHqoINN

— PeckShield Inc. (@peckshield) October 27, 2021

• The price of CREAM plunged -27% minutes after the attack, down from $152 to $111, according to data from CoinGecko.
• This is the third time Cream Finance has suffered a security breach this year alone. As CryptoPotato reported on August 30, the lending protocol was hacked through reentrancy on the AMP token contract, losing an estimated $25 million in AMP coins and ERC-20 tokens.
• This is not only Cream Finance’s biggest hack – it’s the third-largest in DeFi history, according to some estimations. While Rekt’s leaderboard has not been updated, this hack moves EasyFi’s $59 million exploit to the 4th spot, while Poly Network and Compound remain the leaders of the board.