Cream Finance
A cross-chain lending protocol drained of about $130M on October 27, 2021 via a flash-loan price-oracle manipulation of a Yearn yUSD vault — the largest of three exploits Cream suffered in 2021.
Also known as: Cream Finance, C.R.E.A.M. Finance, CREAM
Summary
Cream Finance was a decentralized cross-chain lending protocol. On October 27, 2021, an attacker used flash loans (borrowing hundreds of millions in DAI and ETH) to manipulate the price oracle for a Yearn yUSD vault that Cream used to value collateral, then borrowed against the inflated collateral to drain about $130 million from Cream's Ethereum v1 markets. [1][2]
Context
It was the largest of three flash-loan exploits Cream suffered in 2021 (after ~$37.5M in February and ~$18.8M in August). Yearn recovered about $9.42 million that the attacker had "donated" to the vault during the attack and returned it to Cream's multisig. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
