{"investigation":{"slug":"crema-finance","entity_name":"Crema Finance","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Crema Finance is a Solana-based concentrated liquidity market maker (CLMM) DEX protocol that launched in January 2022. On July 2, 2022, the protocol suffered a critical exploit in which an attacker used a fake tick account and flash loans to drain approximately $8.78 million from multiple liquidity pools. Following on-chain negotiations, the attacker returned roughly $7.1 million and retained approximately $1.68 million as an agreed white-hat bounty; Crema subsequently issued a CRM token compensation plan for affected users and submitted a revised codebase for re-audit by SlowMist before reopening.","sections":[{"content":"On July 2, 2022, Crema Finance's Concentrated Liquidity Market Maker pools on Solana were exploited in an attack that drained approximately $8.78 million in cryptocurrency. The attacker's method centered on a vulnerability in how Crema's protocol validated tick accounts — dedicated storage accounts for price tick data used in fee calculations. The attacker created a fraudulent tick account and circumvented the protocol's owner verification check by writing the initialized tick address of the pool into the fake account. Having established control over fee data, the attacker obtained flash loans from Solend (a Solana lending protocol), deposited borrowed liquidity into Crema's CLMM pools via the DepositFixTokenType() function, then called Claim() to extract inflated fees calculated against the falsified tick data, and finally withdrew the initial liquidity deposit via WithdrawAllTokenTypes(). Stolen funds were converted into 69,422.9 SOL and 6,497,738 USDC, then the USDC was bridged to Ethereum via Wormhole and swapped for approximately 6,064 ETH. The attacker's primary Ethereum address was identified as 0x8021b2962dB803b73Aa874030B0B42c202E8458F. Crema Finance suspended all smart contract operations immediately following detection. The protocol's total value locked dropped from over $12 million on the day before the attack to approximately $3 million by the following business day. Security researchers at Halborn, CertiK, and Ackee Blockchain each independently confirmed that the root cause was inadequate validation of input accounts, a vulnerability pattern that appeared in multiple Solana DeFi exploits during 2022.","heading":"July 2022 Flash Loan Exploit","sources":[{"url":"https://www.coindesk.com/tech/2022/07/04/solana-defi-protocol-crema-loses-88m-in-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-crema-finance-hack-july-2022","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/4XzSJEeWC2bRppR9CeBckw-crema-finance-exploit","name":"certik.com","type":"other","credibility":3},{"url":"https://ackee.xyz/blog/2022-solana-hacks-explained-crema-finance/","name":"ackee.xyz","type":"other","credibility":3},{"url":"https://therecord.media/nearly-9-million-stolen-from-defi-platform-crema-finance","name":"therecord.media","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Crema Finance sent an on-chain message to the attacker's Ethereum address offering an $800,000 white-hat bounty in exchange for the return of stolen funds, along with a 72-hour deadline. Initial on-chain activity suggested the attacker was not complying. Negotiations continued and on July 6, 2022 — four days after the exploit — Crema Finance announced an agreement had been reached. The attacker agreed to retain 45,455 SOL (worth approximately $1.68 million at the time of the deal) as a white-hat bounty and returned the remainder across four separate transactions: 6,064 ETH and 23,967.9 SOL. Total recovered value was approximately $7.1 million, representing roughly 81 percent of the stolen funds. Crema Finance designated the attacker a 'white hat' and stated it was unlikely to pursue legal action against the still-unidentified individual or group. The identity of the attacker was never publicly disclosed. Observers noted that framing a non-consensual exploit as a 'white hat' situation — and allowing the attacker to keep nearly $1.7 million — is a subject of ongoing debate in the DeFi security community regarding whether such arrangements appropriately deter future attacks or implicitly reward them.","heading":"Negotiated Fund Recovery and White-Hat Bounty","sources":[{"url":"https://www.coindesk.com/tech/2022/07/07/crema-finance-attacker-returns-almost-8m-keeps-17m-bounty","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/crema-hacker-returns-8m-keeps-1-6m-in-deal-with-protocol","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/crema-hacker-returns-8-million-114746305.html","name":"finance.yahoo.com","type":"other","credibility":3},{"url":"https://news.bitcoin.com/crema-finance-hacker-negotiates-with-defi-projects-team-returns-8-million-in-eth-and-sol/","name":"news.bitcoin.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the partial fund recovery, Crema Finance published a formal compensation plan. The team allocated 15,000,000 CRM tokens (1.5% of the protocol's total hard-cap token supply) from the team's own allocation to cover affected user losses. At the time of announcement, the CRM tokens were valued at approximately $1.8 million against estimated user net losses of approximately $1.4 million. Liquidity providers in the five directly attacked pools (USDT-USDC, mSOL-SOL, stSOL-SOL, PAI-USDC, and USDH-USDC) were able to withdraw 84 percent of their assets, while liquidity providers in unaffected pools retained full withdrawal access. CRM compensation tokens were distributed under a linear vesting schedule over 12 months, with the first unlock on August 1, 2022. Affected users received a veNFT upon withdrawal enabling them to claim CRM compensation, participate in staking, and vote in DAO governance. Crema also committed to allocating 7.5% of protocol trading fees to monthly CRM buybacks and token burns after full relaunch to support token value. The compensation plan was funded using team-reserved tokens rather than protocol treasury assets, and the attacker's retained bounty ($1.68 million) represented a net loss that was not fully covered by the recovered funds alone.","heading":"User Compensation Plan","sources":[{"url":"https://medium.com/@Crema.finance/the-compensation-plan-regarding-cremas-exploit-incident-62fb9ba4c4bc","name":"medium.com","type":"other","credibility":3},{"url":"https://www.investing.com/news/cryptocurrency-news/crema-finance-team-announces-compensation-plan-following-attack-2845567","name":"investing.com","type":"other","credibility":3},{"url":"https://www.bankinfosecurity.com/crema-finance-issues-recovery-plans-after-88-m-crypto-hack-a-19545","name":"bankinfosecurity.com","type":"other","credibility":3}],"severity":"medium"},{"content":"After suspending operations, Crema Finance submitted a new codebase to SlowMist, a prominent blockchain security firm, for a full smart contract audit before reopening. The protocol announced it would go live again only after the new audit was completed. This represents Crema's remediation response to the inadequate input account validation identified as the root cause of the July 2022 exploit. Security researchers at CertiK, Halborn, and Ackee Blockchain separately analyzed the attack vector post-incident. Notably, the Ackee Blockchain analysis observed that Crema Finance's core codebase was closed-source at the time of the exploit, which limited independent pre-exploit auditing coverage and reduced transparency for third-party security review. The protocol's website remained active as of 2024-2025, but DeFiLlama data indicated a TVL of approximately $124,000 and near-zero daily trading volume as of mid-2025, suggesting the protocol had experienced severe attrition following the incident despite its formal re-launch.","heading":"Security Audit and Re-Launch","sources":[{"url":"https://tokeninsight.com/en/news/crema-finance-to-go-live-again-after-new-smart-contract-audit","name":"tokeninsight.com","type":"other","credibility":3},{"url":"https://ackee.xyz/blog/2022-solana-hacks-explained-crema-finance/","name":"ackee.xyz","type":"other","credibility":3},{"url":"https://defillama.com/protocol/crema-finance","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Crema Finance launched its mainnet on January 1, 2022 as a concentrated liquidity DEX on Solana, analogous in design to Uniswap v3's CLMM model. The protocol is reported to have raised approximately $1.54 million from investors including Ignite Ventures, Techstars, Connetic Ventures, RevTech Labs Capital, and Angel Hub, according to Crunchbase. The team includes CEO Alex Xiong and a co-founder identified as Bernd who managed branding and marketing. The July 2022 exploit occurred only six months after mainnet launch, raising questions about the adequacy of pre-launch security review for a closed-source protocol handling user funds. The exploit was described by some researchers as 'the fourth serious breach' of the protocol, though independent confirmation of prior incidents with specific loss amounts was not found in the sources reviewed for this investigation. The hacker's identity was never disclosed and no law enforcement action was reported. Post-exploit, the protocol's user base and TVL declined sharply. Crema Finance is a distinct entity from C.R.E.A.M. Finance (an Ethereum-based lending protocol that suffered three separate large exploits in 2021 totaling nearly $200 million) and the two should not be confused.","heading":"Protocol Background and Risk Context","sources":[{"url":"https://www.crunchbase.com/organization/crema-finance","name":"crunchbase.com","type":"other","credibility":3},{"url":"https://tokeninsight.com/en/coins/crema-finance/team","name":"tokeninsight.com","type":"other","credibility":3},{"url":"https://solanacompass.com/projects/crema-finance","name":"solanacompass.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/crema-finance","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, an independent on-chain investigator known for tracking crypto exploits and fraud, flagged Crema Finance in the context of the July 2022 exploit and its aftermath. No evidence was found in reviewed sources of ZachXBT alleging team misconduct, rug pull behavior, or insider involvement in the Crema Finance exploit. The flag appears to be consistent with ZachXBT's broader practice of tracking and documenting significant DeFi security incidents on Solana. The nature of the incident — a smart contract exploit rather than a team-driven fraud — means the trust concern primarily relates to protocol security practices rather than alleged bad-faith conduct by founders. Community discussions on platforms such as Twitter and Reddit raised concerns about the adequacy of the compensation plan, the team's decision to treat the attacker as a 'white hat' without verifying intent, and the closed-source nature of the codebase at the time of the breach, though these discussions are categorized as low-credibility Tier 3 sources and are noted without independent verification.","heading":"ZachXBT and Community Flags","sources":[{"url":"https://www.coindesk.com/tech/2022/07/07/crema-finance-attacker-returns-almost-8m-keeps-17m-bounty","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=crema-finance-hacked-for-8-8-million","name":"web3isgoinggreat.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022","event":"Crema Finance mainnet launches on Solana as a concentrated liquidity DEX protocol.","source":"","date_original":"2022-01-01"},{"date":"2022-07-02","event":"Attacker exploits Crema Finance's CLMM pools using a fake tick account and flash loans from Solend, draining approximately $8.78 million in SOL and USDC. Protocol suspends all smart contract operations immediately.","source":""},{"date":"2022-07-02","event":"Stolen funds converted to 69,422.9 SOL and 6,497,738 USDC; USDC is bridged to Ethereum via Wormhole and swapped to approximately 6,064 ETH. Attacker's Ethereum address identified as 0x8021b2962dB803b73Aa874030B0B42c202E8458F.","source":""},{"date":"2022-07-02","event":"Crema Finance TVL drops from over $12 million to approximately $3 million following the exploit.","source":""},{"date":"2022-07-03","event":"Crema Finance sends on-chain message to attacker's Ethereum address offering an $800,000 white-hat bounty with a 72-hour return deadline.","source":""},{"date":"2022-07-06","event":"Crema Finance and the attacker reach a negotiated agreement. Attacker retains 45,455 SOL (~$1.68 million) as a white-hat bounty and returns 6,064 ETH and 23,967.9 SOL across four transactions.","source":""},{"date":"2022-07-07","event":"Crema Finance publicly announces the recovery agreement, designates the attacker a 'white hat,' and commits to releasing a compensation plan within 48 hours.","source":""},{"date":"2022-07-08","event":"Crema Finance publishes compensation plan: 15 million CRM tokens (1.5% of total hard-cap) allocated from team reserves, distributed via 12-month linear vesting starting August 1, 2022. Affected pool users may withdraw 84% of assets immediately.","source":""},{"date":"2022-08","event":"First monthly CRM compensation token unlock for affected liquidity providers.","source":"","date_original":"2022-08-01"},{"date":"2022-10","event":"Crema Finance submits revised codebase to SlowMist for a new smart contract security audit ahead of planned re-launch.","source":"","date_original":"2022-10-01"},{"date":"2025-05","event":"Protocol remains nominally live with a TVL of approximately $124,000 and near-zero daily trading volume, indicating severe user attrition since the 2022 exploit.","source":"","date_original":"2025-05-01"}],"sources_used":[{"url":"https://www.coindesk.com/tech/2022/07/04/solana-defi-protocol-crema-loses-88m-in-exploit","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-crema-finance-hack-july-2022","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260207110427/https://www.halborn.com/blog/post/explained-the-crema-finance-hack-july-2022","credibility":3,"archive_timestamp":"2026-02-07T11:04:27+00:00"},{"url":"https://www.certik.com/resources/blog/4XzSJEeWC2bRppR9CeBckw-crema-finance-exploit","name":"certik.com","type":"other","archive_url":"https://web.archive.org/web/20260830003746/https://www.certik.com/blog/4XzSJEeWC2bRppR9CeBckw-crema-finance-exploit","credibility":3,"archive_timestamp":"2026-08-30T00:37:46+00:00"},{"url":"https://ackee.xyz/blog/2022-solana-hacks-explained-crema-finance/","name":"ackee.xyz","type":"other","archive_url":"https://web.archive.org/web/20260829123529/https://ackee.xyz/blog/2022-solana-hacks-explained-crema-finance/","credibility":3,"archive_timestamp":"2026-08-29T12:35:29+00:00"},{"url":"https://therecord.media/nearly-9-million-stolen-from-defi-platform-crema-finance","name":"therecord.media","type":"other","archive_url":"http://web.archive.org/web/20260608151146/https://therecord.media/nearly-9-million-stolen-from-defi-platform-crema-finance","credibility":3,"archive_timestamp":"2026-06-08T15:11:46+00:00"},{"url":"https://www.coindesk.com/tech/2022/07/07/crema-finance-attacker-returns-almost-8m-keeps-17m-bounty","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20251117232601/https://www.coindesk.com/tech/2022/07/07/crema-finance-attacker-returns-almost-8m-keeps-17m-bounty","credibility":3,"archive_timestamp":"2025-11-17T23:26:01+00:00"},{"url":"https://cointelegraph.com/news/crema-hacker-returns-8m-keeps-1-6m-in-deal-with-protocol","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20251220104424/https://cointelegraph.com/news/crema-hacker-returns-8m-keeps-1-6m-in-deal-with-protocol","credibility":3,"archive_timestamp":"2025-12-20T10:44:24+00:00"},{"url":"https://finance.yahoo.com/news/crema-hacker-returns-8-million-114746305.html","name":"finance.yahoo.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://news.bitcoin.com/crema-finance-hacker-negotiates-with-defi-projects-team-returns-8-million-in-eth-and-sol/","name":"news.bitcoin.com","type":"other","archive_url":"http://web.archive.org/web/20251117140547/https://news.bitcoin.com/crema-finance-hacker-negotiates-with-defi-projects-team-returns-8-million-in-eth-and-sol/","credibility":3,"archive_timestamp":"2025-11-17T14:05:47+00:00"},{"url":"https://medium.com/@Crema.finance/the-compensation-plan-regarding-cremas-exploit-incident-62fb9ba4c4bc","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.investing.com/news/cryptocurrency-news/crema-finance-team-announces-compensation-plan-following-attack-2845567","name":"investing.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.bankinfosecurity.com/crema-finance-issues-recovery-plans-after-88-m-crypto-hack-a-19545","name":"bankinfosecurity.com","type":"other","archive_url":"https://web.archive.org/web/20260830044319/https://www.bankinfosecurity.com/crema-finance-issues-recovery-plans-after-88-m-crypto-hack-a-19545","credibility":3,"archive_timestamp":"2026-08-30T04:43:19+00:00"},{"url":"https://tokeninsight.com/en/news/crema-finance-to-go-live-again-after-new-smart-contract-audit","name":"tokeninsight.com","type":"other","archive_url":"http://web.archive.org/web/20251007122401/https://tokeninsight.com/en/news/crema-finance-to-go-live-again-after-new-smart-contract-audit","credibility":3,"archive_timestamp":"2025-10-07T12:24:01+00:00"},{"url":"https://defillama.com/protocol/crema-finance","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250909133658/https://defillama.com/protocol/crema-finance","credibility":3,"archive_timestamp":"2025-09-09T13:36:58+00:00"},{"url":"https://www.crunchbase.com/organization/crema-finance","name":"crunchbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://tokeninsight.com/en/coins/crema-finance/team","name":"tokeninsight.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://solanacompass.com/projects/crema-finance","name":"solanacompass.com","type":"other","archive_url":"http://web.archive.org/web/20260512035303/https://solanacompass.com/projects/crema-finance","credibility":3,"archive_timestamp":"2026-05-12T03:53:03+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=crema-finance-hacked-for-8-8-million","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260414221926/https://www.web3isgoinggreat.com/?id=crema-finance-hacked-for-8-8-million","credibility":3,"archive_timestamp":"2026-04-14T22:19:26+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:49.010493+00:00","updated_at":"2026-08-30T05:14:13.028829+00:00"}}