Hacker Withdraws $ 25.6 Million Crypto Assets From DeFi Cream Finance Platform

The DeFi Cream Finance project has fallen victim to a quick loan attack. The hacker withdrew more than 418 million AMP control tokens and 1,308 ETH.

This morning, the developers of the Cream Finance decentralized finance platform reported
tweeted that the Ethereum CREAM v1 market was under attack. 418 311 571 AMP and 1 308.09 ETH were withdrawn from the platform as a result of re-entering the AMP token contract.

C.R.E.A.M. v1 market on Ethereum has suffered an exploit, resulting in a loss of 418,311,571 in AMP and 1,308.09 in ETH, by way of reentrancy on the AMP token contract.

We have stopped the exploit by pausing supply and borrow on AMP. No other markets were affected.

— Cream Finance (@CreamdotFinance) August 30, 2021

The total dollar value of the stolen cryptoassets exceeds $ 25.6 million. According to CoinMarketCap, the value of the AMP protocol control token decreased by 15% as a result of the attack. The attacker’s address now contains cryptoassets worth more than $ 18 million. Cream Finance team suspended
loans in AMP to avoid further losses.

Cream Finance is a decentralized finance (DeFi) platform that allows users to earn interest on lending crypto assets. Cream Finance is a fork of the Compound codebase.

PeckShield analysts explainedthat the hacker managed to get a quick loan of 500 ETH. He used it to uncover the capabilities of a “re-entry error” vulnerability found in the Ampleforth smart contract.

2/4 The hack is made possible due to a reentrancy bug introduced by $AMP, which is an ERC777-like token and exploited to re-borrow assets during its transfer before updating the first borrow. pic.twitter.com/oVg0w1FWFt

— PeckShield Inc. (@peckshield) August 30, 2021

Yesterday, the xToken decentralized finance project was hacked for the second time in a year. Attackers discovered a vulnerability in the xSNX smart contract and withdrew $ 4.5 million worth of tokens.