Refreshed 2h ago· updates every 6h
Cream Finance (2021) — Crypto Hack
LaunderedOct 27, 2021·
Ethereum
Amount Stolen
$130.0M
418M in various tokens
Recovered
$0
Flash loan attack exploiting a price manipulation vulnerability in Cream's lending protocol drained $130M.
Summary
Flash loan attack exploiting a price manipulation vulnerability in Cream's lending protocol drained $130M.
How It Was Compromised — DeFi via Flash Loan
DeFiFlash Loan
The attacker used two flash loans totaling $1.5B to manipulate the price of yUSD (Yearn's interest-bearing stablecoin), which was used as collateral in Cream. By inflating yUSD's price, they borrowed far more than the actual collateral value, draining the protocol's reserves.
Fund Flow & Laundering Analysis
Stolen funds converted and moved through Tornado Cash. Attacker's identity linked to previous Cream hacks. Funds dispersed across multiple wallets. This was Cream's third major hack in 2021, raising serious concerns about protocol security culture.
Related Incidents
Vulcan Forged
Vulcan Forged (2021) — DeFi on Ethereum, Polygon
$140.0M
2021·Fully Recovered
BadgerDAO
BadgerDAO (2021) — DeFi on Ethereum
$120.0M
2021·Partially Recovered
Compound
Compound (2021) — DeFi on Ethereum
$80.0M
2021·Laundered
EasyFi
EasyFi (2021) — DeFi on Ethereum, Polygon
$80.0M
2021·Laundered
bZx Protocol
bZx Protocol (2021) — DeFi on Ethereum, BSC, Polygon
$55.0M
2021·Laundered
Alpha Finance / Alpha Homora
Alpha Finance / Alpha Homora (2021) — DeFi on Ethereum
$37.5M
2021·Laundered