Challenge Protocol Ethereum Cream Finance suffered an exploit yesterday that allowed attackers to steal $ 130 million of its holdings. The news was first revealed by Peckshield, a blockchain analytics company that discovered a flash loan had exploited the platform. This is the third hack suffered by the protocol in its history, having previously been exploited for $ 36 million and $ 29 million respectively.
Cream Finance Hacked Yet Again
Cream Finance, an Ethereum-based lending and borrowing protocol, suffered an exploit that allowed the hackers to steal $130 million worth of ether and ERC-20 tokens. According to Slow mist, a blockchain security organization, the attack brought in 2,760.22 ethers and 60 tokens, including HBTC, USDT, BUSD and others. The attack was perpetrated in the form of a series of flash loans in a very unorthodox way, which has led some to think the hacker was an experienced defi developer.
Another blockchain security firm, Peckshield, broke the news, in connection with the flash loan that caused the hack via Twitter. The firm supposed the attack was possible due to a bug in a price oracle. The Cream team quickly recognized the situation, notifying users of the hack. They also said:
With the help of friends from Yearn Finance and others in the community, we were able to identify the vulnerabilities and patch them. In the meantime, we have suspended our v1 loan markets on Ethereum and are in the process of preparing for a post-mortem review.
Suspicious Circumstances
The Cream Finance team has since been trying to communicate with the hackers, offering to give them 10% of all the tokens that were lost. This is a known strategy that has worked for some protocols that have been exploited in the past. However, no response has been received.
The exploit transaction carries an enigmatic message that seems to point in the direction of this being a directed action against the protocol. The post, which also mentioned other protocols, said:
gÃTµ Baave lucky, iron bank lucky, cream not. ydev : incest bad, dont do.
This is not the first time that Cream has been exploited. The protocol has a pretty bad track record, having been exploited three times during this year. The first time, in February, the protocol’s Iron Bank lost $36 million in another flash loan attack. After this event, Cream Finance was hacked again in August, when an exploit caused losses of $ 29 million.
