Canada Markets open in 3 hrs 21 mins
  • S&P/TSX

    20,464.60
    -195.39 (-0.95%)
     
  • S&P 500

    4,513.04
    -53.96 (-1.18%)
     
  • DOW

    34,022.04
    -461.68 (-1.34%)
     
  • CAD/USD

    0.7817
    +0.0010 (+0.1274%)
     
  • CRUDE OIL

    67.07
    +1.50 (+2.29%)
     
  • BTC-CAD

    72,173.85
    -1,189.65 (-1.62%)
     
  • CMC Crypto 200

    1,440.17
    -28.91 (-1.97%)
     
  • GOLD FUTURES

    1,776.60
    -7.70 (-0.43%)
     
  • RUSSELL 2000

    2,147.42
    -51.49 (-2.34%)
     
  • 10-Yr Bond

    1.4340
    0.0000 (0.00%)
     
  • NASDAQ futures

    15,934.00
    +64.25 (+0.40%)
     
  • VOLATILITY

    28.23
    +1.04 (+3.82%)
     
  • FTSE

    7,129.14
    -39.54 (-0.55%)
     
  • NIKKEI 225

    27,753.37
    -182.25 (-0.65%)
     
  • CAD/EUR

    0.6891
    -0.0002 (-0.03%)
     

Cream Finance Exploited in Flash Loan Attack Netting Over $100M

  • Oops!
    Something went wrong.
    Please try again later.
  • Oops!
    Something went wrong.
    Please try again later.
·1 min read
In this article:
  • Oops!
    Something went wrong.
    Please try again later.
  • Oops!
    Something went wrong.
    Please try again later.

Decentralized finance (DeFi) money market and lending service C.R.E.A.M. Finance appears to have been the target of a devastating exploit Wednesday morning that drained over $260 billion in funds, likely the second-largest exploit to date.

According to Cream’s native front end, most Ethereum-based pools are now empty with the exception of a $40 million $CREAM pool. As of Oct 23, the protocol’s Ethereum markets had $300 million worth of assets.

Cream’s official Twitter account acknowledged the attack in a Tweet:

Per DeFillama, the protocol has an additional $460 million in total value locked (TVL) across Binance Smart Chain, Polygon, Avalanche and Fantom. It is unclear if those funds are also at risk.

The funds appear to have been taken using a flash loan in a notably complex transaction that involved 68 different assets and cost over 9 ETH in gas. Of the $260 million lost, the attacker netted roughly $130 million in various cryptocurrencies, of which $40.6 million may be in illiquid crETH, a staked ETH derivative that may prove difficult for the attacker to sell.

The attacker is now working to “wash” the funds primarily using Ren’s Bitcoin bridge. As is often the case following exploits, individuals are now using Ethereum transactions to ask for donations.

A Cream representative did not respond to a request for comment by press time.

UPDATE (Oct. 27 16:07 UTC): Added TVL information, market size information, and new developments from attacker’s Ethereum address. Removed reference to Curve’s 3Pool as a mixer.

Our goal is to create a safe and engaging place for users to connect over interests and passions. In order to improve our community experience, we are temporarily suspending article commenting