Oct. 28, 2021: C.R.E.A.M.-ed 📉💥
$130MM Drained in Third Largest DeFi Hack
Chaos Rule Everything Around Me
C.R.E.A.M. was exploited for $130MM worth of tokens in a major hack that will land in the bronze medal spot on Rekt.
Or if you prefer to count by total lifetime hack volume, it would shoot into second place. C.R.E.A.M. has been already been hacked at least 3 times, with some users recalling even more.
Early returns on our poll suggest the easiest path to wealth in 2021 is not a bag of SHIBA, but simply hacking the porous protocol.
What exactly happened in this case? Early analysis suggests it was a flash loan attack that manipulated the price of the $yUSD vault. The most comprehensive thread we’ve found belongs to @Mudit__Gupta.
More details to come, but the analysis suggests the attack may have been executed by DeFi devs, leading to plenty of rumors that this was an inside job.
Another great analysis by PeckShield illustrates the specific mechanics of how the hack went down.
The breakdown of tokens stolen is something to behold. Lots of ETH and altcoins.
You can browse the hacker addresses yourself if you want to peer in on the action:
The proceeds includes at least $10MM in Curve, mostly in $CRV but also some in pool tokens.
Of course, Curve has no known censorship mechanisms, so it’s not out of the question that the hacker is furiously poring through Curve Market Cap reruns trying to figure out the best way to optimize yield on this fat stack. If so, please consider a subscription. All proceeds go to support PAC DAO crypto activism.
Thankfully the damage appears limited to C.R.E.A.M. The Yearn team is assisting with the investigation and helping conduct a post mortem.
As always, throughout the process the Ethereum blockchain did double duty as a rare censorship-resistant social network. The full archive of messages is a chuckle:
One interesting question is the role of DeFi insurance in hacks of such magnitude.
It’s a question I commonly receive, but I have zero practical experience with DeFi insurance. I like to live dangerously… or more precisely… “Sorry ser, we don’t insure wallets of such modest backgrounds.”
In this case a relatively small number of people likely purchased insurance, so it’s not likely to break the bank. Yet C.R.E.A.M. has over $2 billion in value locked. In a scenario in which many more people purchased DeFi insurance and a major hack went down, it’s hard to imagine how insurance would cover a massive attack.
It’s a reminder to stay safe out there. If you don’t protect yourself, Uncle Sam might “protect” you instead, and nobody yet sells insurance for that.