Crema Finance
Summary
Crema Finance is a Solana-based concentrated liquidity market maker (CLMM) DEX protocol that launched in January 2022. On July 2, 2022, the protocol suffered a critical exploit in which an attacker used a fake tick account and flash loans to drain approximately $8.78 million from multiple liquidity pools. Following on-chain negotiations, the attacker returned roughly $7.1 million and retained approximately $1.68 million as an agreed white-hat bounty; Crema subsequently issued a CRM token compensation plan for affected users and submitted a revised codebase for re-audit by SlowMist before reopening.
Connected Entities
1 entitiesTimeline(11 events)
2022-01-01
Crema Finance mainnet launches on Solana as a concentrated liquidity DEX protocol.
2022-07-02
Attacker exploits Crema Finance's CLMM pools using a fake tick account and flash loans from Solend, draining approximately $8.78 million in SOL and USDC. Protocol suspends all smart contract operations immediately.
2022-07-02
Stolen funds converted to 69,422.9 SOL and 6,497,738 USDC; USDC is bridged to Ethereum via Wormhole and swapped to approximately 6,064 ETH. Attacker's Ethereum address identified as 0x8021b2962dB803b73Aa874030B0B42c202E8458F.
2022-07-02
Crema Finance TVL drops from over $12 million to approximately $3 million following the exploit.
2022-07-03
Crema Finance sends on-chain message to attacker's Ethereum address offering an $800,000 white-hat bounty with a 72-hour return deadline.
2022-07-06
Crema Finance and the attacker reach a negotiated agreement. Attacker retains 45,455 SOL (~$1.68 million) as a white-hat bounty and returns 6,064 ETH and 23,967.9 SOL across four transactions.
2022-07-07
Crema Finance publicly announces the recovery agreement, designates the attacker a 'white hat,' and commits to releasing a compensation plan within 48 hours.
2022-07-08
Crema Finance publishes compensation plan: 15 million CRM tokens (1.5% of total hard-cap) allocated from team reserves, distributed via 12-month linear vesting starting August 1, 2022. Affected pool users may withdraw 84% of assets immediately.
2022-08-01
First monthly CRM compensation token unlock for affected liquidity providers.
2022-10-01
Crema Finance submits revised codebase to SlowMist for a new smart contract security audit ahead of planned re-launch.
2025-05-01
Protocol remains nominally live with a TVL of approximately $124,000 and near-zero daily trading volume, indicating severe user attrition since the 2022 exploit.
Decision Log
- hash: GuRNxpn4ubZdB3HyHo28YGK9aXEdKV5pYLn6zb4FKgor
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:49 AM
last updated: 5/27/2026, 6:12:29 PM
avoid.net — verified advice for a post-truth world