Crema Finance Team Announces Stakeholder Feedback Initiative

The Crema Finance-based liquidity protocol Solana was hacked over the weekend, resulting in more than $8.78 million worth of cryptocurrencies being stolen from its platform, developers said in a tweet.

After the vulnerability was discovered, Crema said it had suspended its smart contract. The protocol allows liquidity providers to set specific price ranges, add single-sided liquidity and conduct range order trading. This creates a sophisticated and decentralized trading platform.

The developers said in a tweet that they were working with several security institutes and other organizations to track the hacker's funds.

On Monday, the value of Crema fell to $3 million from over $12 million on Saturday after the exploit was discovered, a report showed. Since its start in January, Crema's trading volume has been $1.34 billion.

The attacker started by creating a fake tick account. A tick account is "a dedicated account that stores price tick data in CLMM," the developers said, referring to Crema's market making protocol. After that, the attacker used a command to write data on the fake account and circumvent security measures.

The attacker used a flash loan to manipulate the prices of assets on liquidity pools. The false data entries and that manipulation allowed the attacker to claim “a huge fee amount out from the pool.”

Smart contracts can be used to borrow unsecured loans from lenders by traders using flash loans.

The stolen funds were converted to 69422.9 solaras (SOL) and 6,497,738 US dollars coin (USDC). The USDC-based on Solana was then bridged to the Ethereum network via Wormhole and swapped to 6,064 ethers (ETH). These funds amount to over $8.5 million at current prices.

The attacker's Ethereum address, as flagged by blockchain scanning tool Etherscan, had not moved the stolen funds or converted to other coins at writing time, the data indicate.