CREAM Lending

On October 27, 2021, the Ethereum lending protocol Cream Finance lost roughly $130 million in a single sequence of transactions to an attacker who manipulated the internal price Cream used to value a yield-bearing collateral token. It was Cream's third major exploit of 2021, following losses of $37.5 million in February and roughly $18.8 million in August (Decrypt).

How the attack worked

The target wasn't an external price feed like Chainlink — it was Cream's own accounting oracle for yUSDVault, a Yearn vault token accepted as collateral. That oracle priced each vault share as total value locked in the vault divided by total supply of shares. Both sides of that fraction could be moved by a single actor inside one transaction, and that is the flaw the attacker used (Halborn).

Using two coordinated addresses and flash loans drawn from MakerDAO and Aave, the attacker routed borrowed capital through Curve's yPool into yUSD, then into Yearn's yUSDVault strategy, then deposited the resulting vault shares on Cream as collateral to mint crYUSD and borrow further. Repeating this cycle built a real collateral position of roughly $1.5 billion in crYUSD spread across the two addresses (Rekt).

The final step was the manipulation itself: the attacker redeemed roughly $500 million worth of yUSDVault shares back into underlying yUSD in one transaction. That sharply cut the vault's total share supply while its total value barely moved — which, under Cream's pricing formula, roughly doubled the value attributed to every share still sitting on Cream's books. The attacker's real ~$1.5 billion in collateral was suddenly read by the protocol as ~$3 billion, and against that phantom balance sheet they borrowed out essentially all of Cream's available liquidity — about $130 million net.

The entire sequence — flash loans in, cycling through Curve and Yearn, the redemption that skewed the price, the borrow, and the flash loan repayment — executed atomically within one bundle of transactions, leaving no window for a keeper, multisig, or price-feed update to intervene.

What happened next

Cream's deployer publicly offered the attacker a 10% "bounty" (roughly $13 million) to return the rest of the funds. The offer went unanswered: the attacker instead routed the stolen assets through Tornado Cash and RenBridge to convert part of them into bitcoin, and dumped a large CRETH2 position on Uniswap (Rekt). No funds were recovered.

Cream Finance did not shut down. It kept operating, but the October hack — its third that year — left it structurally short of the reserves needed for any credible restitution to depositors. By the mid-2020s, independent reviews describe Cream as a legacy protocol with total value locked down to low single-digit millions of dollars, a direct consequence of the trust it lost across its 2021 exploits (CryptoAdventure).

Takeaways

• Any lending market that accepts a yield-bearing "wrapper" token as collateral — vault shares, LP tokens, staked-asset derivatives — inherits the pricing risk of everything nested inside it; a user looking at "collateral: yUSD" has no easy way to see that depth.
• An internal share-price oracle computed as value divided by supply is manipulable whenever a single party can move both the numerator and the denominator within one transaction — a pattern that recurs well beyond this one vault design.
• Flash loans remove the capital constraint entirely: the attacker needed no real capital of their own, only an atomic sequence of calls, so protocol security has to assume attackers can temporarily command unlimited funds within a single block.
• A protocol's own incident history is visible risk information: this was Cream's third exploit in eight months, and TVL did not retreat far enough after the first two to limit the damage of the third.