MARCH 2021




"C.R.E.A.M. Finance is a decentralized lending protocol for individuals, institutions and protocols to access financial services. Part of the yearn finance ecosystem, it is a permissionless, open source and blockchain agnostic protocol serving users on Ethereum, Binance Smart Chain and Fantom. Users who are passively holding Ethereum or Bitcoin can deposit their assets on C.R.E.A.M. to earn yield, similar to a traditional savings account."


"On March 15, C.R.E.A.M. Finance encountered DNS hijacking. Our GoDaddy account was compromised, redirecting users to a phishing page." "GoDaddy DNS CNAME record not pointing to our hosting IP, consistent with the website outage." "[O]ur GoDaddy login credentials were compromised." "The first unusual behavior in GoDaddy activity log is a password reset request sent to attacker’s email address, but there is no record of email address change."


"Earlier today, a similar service called Cream Finance said its DNS (domain name service) had been "compromised by a third party." PancakeSwap’s Twitter account then confirmed that it had been attacked through the same mechanism."


"To our community ~ http://cream.finance and http://app.cream.finance are now considered compromised sites - DO NOT USE either domain until further notice."


"The hijacker appears to be asking users to input the 12-word seed phrase unique to each crypto wallet in order to steal funds."


"[W]e want to thank the community for all of their support while we worked to fix the DNS hijacking issue. W[e w]ant to assure you all that all funds are safe, and we have regained control over our DNS!"

Cream Finance uses GoDaddy as their domain registrar. Due to what appears to be an error in GoDaddy, the attacker was able to change the CNAME records to point the domain name to a server they control. They then modified the site to display a request for the user to enter their seed phrase.


It is not known how many users decided to enter their seed phrase and were affected.


In general, most users are educated against entering their seed phrase on any website, DNS hijacking incidents are relatively rare, and only a small portion of platform users would interact with the platform site while the event happens.


This type of situation is likely best dealt with through education for users, better training for platform operators regarding the proper domain name security, and having a fund set up to assist users in case of loss events.


Check Our Framework For Safe Secure Exchange Platforms

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.