Skip to main content
AVOID.NET
Sign in

Crema Finance

avoid.net/crema-finance→28/100·82% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·aySoks…tf7B

Summary

Crema Finance is a Solana-based concentrated liquidity market maker (CLMM) DEX protocol that launched in January 2022. On July 2, 2022, the protocol suffered a critical exploit in which an attacker used a fake tick account and flash loans to drain approximately $8.78 million from multiple liquidity pools. Following on-chain negotiations, the attacker returned roughly $7.1 million and retained approximately $1.68 million as an agreed white-hat bounty; Crema subsequently issued a CRM token compensation plan for affected users and submitted a revised codebase for re-audit by SlowMist before reopening.

Connected Entities

6 entities · 60 linked investigations
Organizations
□Ethereum64□Wormhole62□Solana62□ZachXBT82
Protocols
⌂Crema Finance⌂Uniswap58
Relationships
  • ZachXBT→mentioned with→Ethereum(70%)
  • Uniswap→mentioned with→Ethereum(80%)
  • Wormhole→mentioned with→Solana(80%)
  • Wormhole→mentioned with→Ethereum(70%)
  • Solana→mentioned with→Ethereum(60%)
  • Crema Finance→mentioned with→Wormhole(65%)
  • Crema Finance→mentioned with→Ethereum(70%)
  • Crema Finance→mentioned with→Uniswap(60%)
  • Crema Finance→mentioned with→ZachXBT(70%)
  • Crema Finance→mentioned with→Solana(80%)
Also appears in
Wormhole·62Solana·62Ethereum·64Lendf.me·30Levyathan·18Jump Trading·42OpenZeppelin AI Exploit Threat Vector·15StableMagnet·2Shibarium·28Dean Daghita / CMDSS (Command Services and Support)·0+ 50 more

Connected Through

5 shared actors · 621 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Crema Finance?

Timeline(11 events)

2022

Crema Finance mainnet launches on Solana as a concentrated liquidity DEX protocol.

2 July 2022

Attacker exploits Crema Finance's CLMM pools using a fake tick account and flash loans from Solend, draining approximately $8.78 million in SOL and USDC. Protocol suspends all smart contract operations immediately.

2 July 2022

Stolen funds converted to 69,422.9 SOL and 6,497,738 USDC; USDC is bridged to Ethereum via Wormhole and swapped to approximately 6,064 ETH. Attacker's Ethereum address identified as 0x8021b2962dB803b73Aa874030B0B42c202E8458F.

2 July 2022

Crema Finance TVL drops from over $12 million to approximately $3 million following the exploit.

3 July 2022

Crema Finance sends on-chain message to attacker's Ethereum address offering an $800,000 white-hat bounty with a 72-hour return deadline.

6 July 2022

Crema Finance and the attacker reach a negotiated agreement. Attacker retains 45,455 SOL (~$1.68 million) as a white-hat bounty and returns 6,064 ETH and 23,967.9 SOL across four transactions.

7 July 2022

Crema Finance publicly announces the recovery agreement, designates the attacker a 'white hat,' and commits to releasing a compensation plan within 48 hours.

8 July 2022

Crema Finance publishes compensation plan: 15 million CRM tokens (1.5% of total hard-cap) allocated from team reserves, distributed via 12-month linear vesting starting August 1, 2022. Affected pool users may withdraw 84% of assets immediately.

August 2022

First monthly CRM compensation token unlock for affected liquidity providers.

October 2022

Crema Finance submits revised codebase to SlowMist for a new smart contract security audit ahead of planned re-launch.

May 2025

Protocol remains nominally live with a TVL of approximately $124,000 and near-zero daily trading volume, indicating severe user attrition since the 2022 exploit.

Provenance & Audit Trail
Anchored on SolanaVerify on-chain14 Wayback Archivessrc:defillama

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 14 of 18 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 5/4/2026, 2:54:49 AM

last updated: 9/15/2026, 5:57:07 PM

4 views

avoid.net — verified advice for a post-truth world