Hack history / 2021 / Hack or exploit
CREAM Lending
Hack or exploit on Oct 27, 2021 · Spot Price Manipulation
ATTACK TX CONFIRMED ON CHAINSOURCES AGREE ON DATE AND LOSS · 5 SOURCES
Lost
$130M
dollars at the time
Returned
none listed
as the sources state it
Rank
#44
among thefts by dollars lost
What happened
On October 27, 2021, CREAM Finance was exploited for $130 million via flashloan-enabled oracle manipulation. Attacker used flashloans from MakerDAO and Aave to manipulate yUSD price, then minted unbacked yUSD and crYUSD by exploiting vault accounting and composability across Curve and Aave.
Details
- Date
- Oct 27, 2021
- Kind
- Hack or exploit
- Method
- Spot Price Manipulation
- How in
- Price, oracle and governance
- Target
- DeFi protocol
- Chains
- Ethereum
- Audit (rekt.news)
- unaudited
After the theft
- Returned by the attacker
- yes, amount not stated
“It is reported that this is the third largest DeFi hacking in history (although the two larger hacking incidents have funds returned), in addition, Cream Finance has suffered multiple lightning loan attacks before, and lost 37.5 million US dollars in February.” (SlowMist Hacked)
Related incidents
Secured Finance Lending 2026 · Hack or exploit · $104K
Moonwell Lending 2026 · Hack or exploit · $8.7M
Surf Lending 2026 · Hack or exploit · undisclosed
DefiTuna Lending 2026 · Hack or exploit · $580K
Fluid Lending 2026 · Hack or exploit · $215K
Moonwell Lending 2026 · Hack or exploit · $8.7M
Surf Lending 2026 · Hack or exploit · undisclosed
DefiTuna Lending 2026 · Hack or exploit · $580K
Fluid Lending 2026 · Hack or exploit · $215K
Cite this page
SwanBluechip, "CREAM Lending hack, Oct 27, 2021: $130M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht6a69c59bbf/ (data as of 2026-10-31).