the central theses
- Hackers raided CremaFinance’s liquidity pools over the weekend, forcing the protocol to pull the plug
- The incident is the latest in a series of exploits that have ravaged the beleaguered decentralized finance sector this year
Solana-based liquidity protocol CremaFinance is the latest DeFi (decentralized finance) platform to fall victim to hackers.
CremaFinance was first brought to the attention of users on Saturday, saying it was temporarily suspending the service and investigating the exploit, which at the time was believed to be more than $6.4 million in digital assets.
That number was later revised to over $8.7 million, Solana blockchain explorer SolanaFM said in a tweet. The hacker exploited a vulnerability in the protocol’s tick account, CremaFinance said.
A tick is a dedicated account that stores price tick data from a Central Liquidity Market Maker (CLMM). In DeFi, CLMMs typically charge transaction fees based on the data in the tick account.
In the case of CremaFinance, the authentic transaction fee data has been replaced with the hacker’s fake data. This allowed the attacker to collect a “huge amount of fees” from CremaFinance’s liquidity pool, resulting in huge losses.
The hacker used a malicious contract and used it to activate six quick loans from the Solana lending platform Solend to provide liquidity to Crema and open their positions, CremaFinance said.
Millions of dollars in various cryptocurrencies including Tether and Lido Staked Solana were stolen. Stolen funds are being held in the hacker’s Ethereum and Solana wallets, which have since been reported by SolanaFM. CremaFinance is yet to confirm exactly how much crypto remains in its pools.
The company announced just two weeks ago that it had raised $5.4 million in a private fundraising round. CremaFinance is not to be confused with DeFi’s Cream Finance, which has faced multiple “flash loan exploits” over the past year, including a $130 million hack in October.
But the incident is the latest in a series of DeFi exploits that have plagued the sector this year. Last month, a hacker stole 20 million governance tokens from Ethereum scaling solution Optimism, worth around $30 million at the time, intended for a loan from major market maker Wintermute.
In the same month, smart contracts platform Elrond Network witnessed about $4 million being withdrawn from its decentralized exchange.
Still, those numbers pale in comparison to February’s $320 million Wormhole hack and April’s $625 million attack on Axie Infinite’s Ronin bridge — the two biggest DeFi thefts to date.
Receive the top crypto news and insights of the day via email every night. Subscribe to Blockworks’ free newsletter now.
Want Alpha delivered straight to your inbox? Get ideas on Epee trading, governance updates, token performance, must-see tweets and more from Blockworks Research’s daily debrief.
can’t wait Receive our news as soon as possible. Join us on Telegram and follow us on Google News.
Learn Crypto Trading, Yield Farms, Income strategies and more at CrytoAnswers
https://nov.link/cryptoanswers
Comments are closed.