$136M Lost as Cream Finance Suffers Another Flash Loan Attack

Key Takeaways

• Cream Finance has been hit for over $136 million in a flash loan attack.
• The stolen funds comprised mainly of LP tokens, several other ERC-20 tokens, and stablecoins.
• Roughly $40 million of the stolen funds are in Cream’s ETH2 custodial staking service, meaning they could potentially be recovered.

“Decentralized lending protocol Cream Finance has been hit by a major flash loan attack. The assailant borrowed $2 billion from Aave and made off with over $136 million worth of Ethereum-based tokens.

Cream Finance Hit By Another Flash Loan Attack

Cream Finance has been exploited.

An attacker successfully used a flash loan earlier today to borrow 524,102.159 ETH from Aave, worth about $2 billion at today’s prices. They then successfully drained Cream Finance of several DeFi tokens, making off with around $136 million at peak prices according to Zerion. The transaction for the attack cost $36,574.34 and can be viewed on Etherscan.

The smart contract auditing firm PeckShield broke the news of the attack on Twitter this afternoon, while Cream Finance announced that it was “investigating an exploit on C.R.E.A.M. v1 on Ethereum.” The team added that it would share further updates as soon as they’re available.

The Etherscan transaction history shows that the attacker moved at least $92 million to one Ethereum wallet and $23 million to another. The stolen funds were mostly comprised mainly of Cream LP tokens, which can be earned for providing liquidity to the protocol, as well as XSUSHI, WNXM, YFI, and several other ERC-20 tokens and stablecoins.”

Read the full article at cryptobriefing.com