Breaking: Cream Finance Gets Exploited For $37.5 million
Cream Finance or Iron Bank has become the latest defi protocol to fall victim to an exploit that possibly leads to a $37.5 million heist. The official Twitter handle of the protocol the issue and said that they were looking into it.
We are aware of a potential exploit and are looking into this. Thank you for your support as we investigate.
— Cream Finance ???? (@CreamdotFinance) February 13, 2021
The attacker managed to exploit a loophole for drawing loans and used Alpha Homora to draw sUSD from the collateral debt position. The hackers kept withdrawing loans larger than the previous one and used two transactions at a time whereas soon as they received the loan they used to send it back into the platform receiving cyUSD. The hacker managed to get a $1.8 million USDC loan from Aave v2 and since they were simultaneously sending back the drawn loan the cycle continued.
The hackers kept repeating this cycle until they hoarded enough cyUSD to borrow anything from the platform. In the end, the hacker borrowed,
- 13.2k WITH
- 3.6M USDC
- 5.6M USDT
- 4.2M DAI
The Hacker Still Holds 11k ETH in the Wallet
The hacker finally used the withdrawn amount of ETH and other tokens to fill the Aave v2 collateral debt position with stablecoins to return the loan that included,
- 1k ETH to IronBank deployer,
- 1k ETH to Homora deployer,
- 220 ETH to Tornado,
- 100 ETH granted to Tornado
Nearly 11k ETH remains on the exploiter balance now. This would mark another sophisticated exploit on a defi protocol which had increased significantly in 2020 as the popularity of the Defi ecosystem grew. Every other week one or the other defi protocol was hacked for millions where in some cases the stolen funds were returned however in most the exploiter got away with millions.
The Alpha Finance lab whose protocol was used for the exploitation has claimed that the breach had been patched. The firm has suspended any active position on Homora v2. The firm said, Users can’t borrow more funds from Alpha Homora v2 = no new leveraged positions and borrow on existing positions.
Users can't borrow more funds from Alpha Homora v2 = no new leveraged positions and borrow on existing positions.
V1 is safe and operational.
We're on full alert and working with @samczsun & many trusted builders to investigate the issues thoroughly.
A post mortem to follow.
— Alpha Finance Lab (@AlphaFinanceLab) February 13, 2021
“V1 is safe and operational We’re on full alert and working with @samczsun & many trusted builders to investigate the issues thoroughly. A post mortem to follow.”
- SpaceX Makes Third Huge Bitcoin Transfer in 10 Days, Is Elon Musk Planning Something Big?
- Crypto Market Tumbles as Jerome Powell Says December Rate Cut ‘Far From Certain’
- FOMC Meeting: Federal Reserve Lowers Interest Rates by 25 Bps in Second Cut of the Year
- WLF Token Jumps 7% as Former Robinhood Counsel Joins Trump-Backed World Liberty Financial
- Changpeng Zhao “CZ” Warns Investors “Don’t Buy” Golden Statue Meme Coin After 27,000% Surge
- Ethereum Price Flips BTC in Strategy Shift, Eyes $4500 Level
- Expert Predicts XRP Price to Hit $10 as Elliot Wave, XRPR ETF Inflows Align
- HYPE Price Prediction as 21Shares Files S-1 for Hyperliquid ETF—Can Bulls Push HYPE to $60?
- Bitcoin Price Rally Bound? How the Fed’s Move May Unleash Crypto
- Can ASTER Price Rebound 50% as Whale Activity and Bullish Pattern Align?
- Pi Network Patterns Point to More Gains Despite Manipulation Claims
MEXC