Pierluigi Paganini October 28, 2021

Threat actors have stolen $130 million worth of cryptocurrency assets from the Cream Finance decentralized finance (DeFi) platform.

C.R.E.A.M. Finance is a decentralized lending protocol for individuals, institutions and protocols to access financial services. It promises earnings to users who are passively holding ETH or wBTC. Threat actors have stolen $130 million worth of cryptocurrency assets from the decentralized finance (DeFi) platform. The attack was also confirmed by the company.

Other blockchain security firms immediately shared the news of the attack:

According to the experts, the attackers have likely exploited a vulnerability in the platform’s flash loan feature, then transferred the stolen funds to a wallet under their control before splitting them through other wallets. Cream Finance has quickly addressed the flaw.

Unfortunately, this is the third time Cream Finance has been hacked this year, in August threat actors have stole $29 million and another $37 million were stolen in February.

DeFi attacks are becoming very profitable for threat actors, according to a recent post published by CipherTrace they totalled 361 million By July 2021 and accounted for 76% of all major hacks in 2021.

“By July 2021, DeFi-related hacks total $361 million, already making up three-quarters of the total hack volume this year—a 2.7x increase from 2020. DeFi-related fraud continues to rise, as well. At the time of this report, DeFi-related fraud accounted for 54% of major crypto fraud volume, whereas last year DeFi-related fraud only made up 3% of the year’s total.” states CipherTrace.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Cream Finance)

[adrotate banner=”5″]

[adrotate banner=”13″]