We are aware of a potential exploit and are looking into this. Thank you for your support as we investigate.
— Cream Finance 🍦 (@CreamdotFinance) February 13, 2021
2/ They do this through two transactions and each time they lend the funds back into IronBank, receiving cySUSD.
3/ At some point exploiter took $1.8M USDC flash loan from Aave v2 and swapped USDC to sUSD using Curve. pic.twitter.com/fSheiqZ6lO
— Igor Igamberdiev (@FrankResearcher) February 13, 2021
A Flash Loan Con
Looks like only ~$23mil in $ETH stolen. Good guy exploiter even was nice enough to send some of that ETH back to Cream and Alpha. Even funded https://t.co/ihTTSzmEw3's Gitcoin grant with 100 ETH. Could have been worse.
— pantsme (@skumbagt) February 13, 2021