Cream Finance has lost over $34 million in cryptocurrency after a cyberattacker exploited a vulnerability in the project's market system.<\/p>\n
The decentralized finance (DeFi) organization is the developer of a lending protocol for individuals, with yields on offer for some cryptocurrency stakes. Assets on the platform include Ethereum (ETH), the AMP token, CREAM token, USDT, and COMP.<\/p>\n
Cream said an attacker managed to exploit a vulnerability on August 31, leading to the theft of 462,079,976 in AMP ($24.2m) tokens and 2,804.96 ETH tokens ($9.9m), according to an update posted on September 1.<\/p>\n
At current prices, this amounts to over $34 million. <\/p>\n
In an analysis of the attack, with the assistance of PeckShield, Cream said an error in how the platform integrated AMP, leading to a reentrancy bug, was the source of the exploit. <\/p>\n
\"While unfortunate and disappointing, we take ownership of the error,\" the developers say. <\/p>\n
Cream is now working with law enforcement to try and trace the attacker -- or, attackers, as the platform says a \"copycat\" was also in play at the time of the main attack. The second individual has a transaction history with Binance. <\/p>\n
The organization has paused AMP supply and borrow functions until a patch can be deployed. The stolen ETH and AMP will be replaced, with 20% of protocol fees now earmarked to repay customers. <\/p>\n
Cream says that if the attacker is willing to return the stolen cryptocurrency, they can keep 10%, without any consequences as a form of bug bounty payment. However, if others are able to provide a lead on the identity of the cyberattacker leading to their arrest and\/or prosecution, 50% of the value of the stolen funds is on offer. as a reward <\/p>\n
If neither offer is successful, \"we will forward all relevant information to law enforcement authorities and prosecute to the fullest extent of the law,\" the company says.<\/p>\n
This is not the first time Cream has fallen foul of a cyberattack. In February, the platform lost $37.5 million due to a flash loan exploit made via IronBank. <\/p>\n
Earlier this month, DeFi platform Poly Network said an attacker exploited a vulnerability in the platform to siphon away roughly $610 million in cryptocurrency, including BSC and ETH. The thief has since returned the funds and is signed off as \"Mr. White Hat\" in Poly blog posts. <\/p>\n
The company has returned assets to its rightful owners and is currently in the process of restoring cross-chain services. <\/p>\n
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0<\/p>\n
<\/p>\n
More: Cream Finance has lost over $34 million in cryptocurrency after a cyberattacker exploited a vulnerability in the project's market system. The decentralized finance (DeFi) organization is the developer of a lending protocol for individuals, with yields on offer for some cryptocurrency stakes. Continue reading
\nCream Finance platform pilfered for over $34 million in cryptocurrency - ZDNet<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"