The crypto platform Cream Finance reports the third major cyber attack on its systems this year. According to the report, one or more hackers succeeded in capturing Ethereum worth 130 million US dollars in the course of a lending process they had manipulated.
According to the website Vice.com, the coup is one of the largest thefts ever to have taken place on such a platform. The criminals resorted to a so-called flash loan attack, a complicated type of lightning loan based on cryptocurrencies. The money is usually issued and repaid in a single transaction using so-called smart contracts.
Analysts believe the attackers used a particularly complex transaction to exploit a vulnerability in Cream Finance’s system. In doing so, they managed to collect the loan without paying it back. The network fees alone for the elaborate attack are said to have amounted to around US$36,000.
Our initial analysis of the Cream Finance attack:https://t.co/TysI7fjyPU@Mudit__Gupta @bantg @CreamdotFinance pic. twitter.com/wScUvizBtX
– BlockSec (@BlockSecTeam) October 27, 2021
Cryptic message poses mystery
The criminals left a cryptic message in the transaction subject, which so far does not allow any conclusions about motive or perpetrators. There, the attackers wrote: “gÃTµ Baave lucky, iron bank lucky, cream not. ydev : incest bad, dont do.” Aave, according to the report, is a competitor platform to Cream, while the Iron Bank platform belongs to Cream itself.
The platform operator announced via Twitter after the attack that the exploited vulnerability had been closed and that it wanted to apologise to its users for the incident.
With the help of friends from @iearnfinance and others in the community, we were able to identify the vulnerabilities and patch them.
In the meantime, we’ve paused our v1 lending markets on Ethereum and we’re in the process of putting together a post-mortem review.
– Cream Finance 🍦 (@CreamdotFinance) October 27, 2021
Earlier in February 2021, hackers had deprived Cream of US$37.5 million in a similar attack. In August 2021, another flash-loan attack followed, in which criminals stole another 18.8 million US dollars.
