Cream Finance Suffers Crypto Hack, Loses USD 130 Million!
Cybercriminals are continuing to cripple the world with their cyber assaults. As organizations embraced remote work, and all its digital implications, malicious actors exploited the crisis to conduct sophisticated attacks and extract huge ransoms.
A recent attack on a decentralized finance (DeFi) company is one such incident among many.
Cybercriminals extorted cryptocurrency assets worth USD 130 million from Cream Finance Hack.
Poly Network hack or Ronin Network crypto heist hold the record of the biggest crypto heist of all time, where hackers hauled away over USD 600 million.
What is Cream Finance?
Cream Finance is a DeFi platform that allows users to loan and speculate on cryptocurrency price variations. The Ethereum-based lending platform is known for drawing in billions of dollars in investor funds, but it has been a frequent target for malicious actors. Hackers used flash loans, a type of uncollateralized lending, to exploit poorly protected protocols.
Also Read: 95% of Ransomware Attacks Target Windows Devices: Google’s VirusTotal
The incident was first detected by blockchain security firms PeckShield and SlowMist with a tweet, highlighting a large flash-loan transaction that conducted the theft.
Cream Finance team confirmed the hack tweeting, “Our Ethereum C.R.E.A.M. v1 lending markets were exploited, and liquidity was removed. The attacker removed a total of USD 130 million USD worth of tokens from these markets. No other impacts on other markets.”
According to the blockchain security firm BlockSec, the hackers exploited a vulnerability in the platform’s lending system, called flash loaning, to steal all of Cream’s assets and tokens running on the Ethereum blockchain.
Also Read: Hackers Exploit BQE Software to Hit a US Engineering Comp
Cream Finance’s stolen crypto assets are available below:
Meanwhile, the Cream Finance team explained the incident as “a mix of economic and oracle exploits. The attacker flash borrowed DAI from MakerDAO to create a large amount of yUSD tokens, while simultaneously exploiting the price oracle calculation for yUSD.”
Nearly six hours after the incident, the DeFi firm informed that it fixed the vulnerability with the help of cryptocurrency platform Yearn.
“We have suspended all interactions with our Ethereum v1 markets. crTokens on C.R.E.A.M. Ethereum v1 markets are locked and cannot be transferred. Our friends at Yearn Finance successfully salvaged USD 9.42 million the attacker “donated” to the yUSD vault,” tweeted Cream Finance.
The company even announced a bug bounty for the hackers, in a bid to entice them to return the tokens.
“We encourage the attacker to reach out and begin a dialogue for the return of our users’ funds. They are impacting everyday users of DeFi, and we would like them to do the right thing. We will honor a bug bounty of 10% upon return of funds,” it tweeted.
Big Three Risks in DeFi Exposed
Unfortunately, the attack on Cream Finance highlighted the big three risks in the DeFi market, according to Stephane Ouellette, CEO of FRNT Financial Inc., a crypto-focused capital-markets platform.
“First, tokens representing very new projects are trading at very large, arguably inflated valuations. Two, the overwhelming majority of the platforms are within a year old, which implies unproven technology.” Said Ouellette.
“Third, the Gensler-led SEC appears to want to regulate these protocols like centralized cryptocurrency lenders like BlockFi and Celsius, which are currently having their regulatory structures challenged in the several U.S. States”, he added.
Also Read: Microsoft Blames Russia for Most Cyberattacks
Third Time’s a Charm!
This is not the first time Cream Finance suffering a breach this year. Before this hack, the DeFi company had been attacked twice this year, wherein hackers stole nearly USD 38 million in February and almost USD 19 million in August.
All these attacks were flash loan exploits, a common attack vector hackers have been using to cripple DeFi platforms for the past two years.
The latest Cream Finance crypto heist stands as the second-largest cryptocurrency hack this year after Ploy Network suffered a USD 600 million heist in August. However, the hacker behind the Poly Network hack has returned almost all of the stolen funds. The return of stolen crypto in the case of Cream Finance seems improbable.
Are You Safe?
Cybercrime can be challenging to combat. With criminals continuously honing their attack skills, it is increasingly difficult for organizations to fortify their defenses while striving for their business objectives.
Partnering with security service providers like StealthLabs can relieve you from the herculean task of securing your business. Let our security experts build a robust cybersecurity posture while you run your business mellifluously. Join forces with us now.
More News: