Cream Finance decentralized lending platform appears to have suffered a serious exploit on Wednesday in which an attacker stole over $ 100 million worth of funds in a major flash credit attack.
Blockchain data analytics firm PeckShield first identified the flash loan on Wednesday. The compromised funds were mostly Cream liquidity provider tokens, as well as other Ethereum-based tokens.
– PeckShield Inc. (@peckshield) October 27, 2021
During a flash loan attack, an attacker exploits vulnerable smart contracts to create their own arbitrage opportunities. Typically it does this by changing the relative value of a trading pair by flooding the contract with their borrowed tokens.
Cream Finance has been routinely targeted by attackers, as evidenced by the $ 19 million flash loan hack of the log in August. As Cointelegraph reported at the time, the attack was facilitated by a re-entry bug introduced by the Amp cryptocurrency, an Ethereum-based token designed to secure digital payments on Flexa. At the time of writing, Cream’s Total Value Locked (TVL) was more than $ 1.5 billion, according to industry sources.
Cream Finance’s forums appear to have been cleared after the attack, despite the log informing its Twitter followers that the flash loan is being investigated. The Twitter thread is full of angry responses about Cream’s poor track record when it comes to protecting user funds.
We are investigating an exploit on C.R.E.A.M. v1 on Ethereum and will share updates as they become available.
– Cream Finance (@CreamdotFinance) October 27, 2021
Related: Hackers Take advantage of MFA flaws to steal 6,000 Coinbase customers – report
While decentralized finance, or DeFi, has been lauded for revolutionizing traditional finance and promoting financial inclusion, the industry’s track record of consumer protection has been poor. A comprehensive list of DeFi attacks revealed 63 exploits as of September 16, with funds lost amounting to around $ 1.2 billion, according to CryptoSec. Cream Finance’s latest exploit would be one of the largest.
Cream Finance’s CREAM token plummeted amid the news, falling more than 26% to $ 115.47, according to Cointelegraph Markets Pro.