Crema Finance
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 54. Problems weighed by who is responsible: incidents the subject suffered −9.6, concerns that are not fraud −6.4, problems around the subject, caused by others −0.8; legitimacy credit long-running +6. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6.4 |
| Incidents it suffered (e.g. hacks) | -9.6 |
| Problems around it, caused by others | -0.8 |
| Long-running | +6 |
| Sum | 54 |
Score: 54/100 (kept between 0 and 100)
How scoring works →Summary
Crema Finance is a Solana-based concentrated liquidity market maker (CLMM) DEX protocol that launched in January 2022. On July 2, 2022, the protocol suffered a critical exploit in which an attacker used a fake tick account and flash loans to drain approximately $8.78 million from multiple liquidity pools. Following on-chain negotiations, the attacker returned roughly $7.1 million and retained approximately $1.68 million as an agreed white-hat bounty; Crema subsequently issued a CRM token compensation plan for affected users and submitted a revised codebase for re-audit by SlowMist before reopening.
Connected Entities
6 entities · 60 linked investigations- ZachXBT→mentioned with→Ethereum(70%)
- Uniswap→mentioned with→Ethereum(80%)
- Wormhole→mentioned with→Solana(80%)
- Wormhole→mentioned with→Ethereum(70%)
- Solana→mentioned with→Ethereum(60%)
- Crema Finance→mentioned with→Wormhole(65%)
- Crema Finance→mentioned with→Ethereum(70%)
- Crema Finance→mentioned with→Uniswap(60%)
- Crema Finance→mentioned with→ZachXBT(70%)
- Crema Finance→mentioned with→Solana(80%)
Connected Through
5 shared actors · 610 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- □Solanaorganization
- ⌂Uniswapprotocol
Timeline(11 events)
2022
Crema Finance mainnet launches on Solana as a concentrated liquidity DEX protocol.
2 July 2022
Attacker exploits Crema Finance's CLMM pools using a fake tick account and flash loans from Solend, draining approximately $8.78 million in SOL and USDC. Protocol suspends all smart contract operations immediately.
2 July 2022
Stolen funds converted to 69,422.9 SOL and 6,497,738 USDC; USDC is bridged to Ethereum via Wormhole and swapped to approximately 6,064 ETH. Attacker's Ethereum address identified as 0x8021b2962dB803b73Aa874030B0B42c202E8458F.
2 July 2022
Crema Finance TVL drops from over $12 million to approximately $3 million following the exploit.
3 July 2022
Crema Finance sends on-chain message to attacker's Ethereum address offering an $800,000 white-hat bounty with a 72-hour return deadline.
6 July 2022
Crema Finance and the attacker reach a negotiated agreement. Attacker retains 45,455 SOL (~$1.68 million) as a white-hat bounty and returns 6,064 ETH and 23,967.9 SOL across four transactions.
7 July 2022
Crema Finance publicly announces the recovery agreement, designates the attacker a 'white hat,' and commits to releasing a compensation plan within 48 hours.
8 July 2022
Crema Finance publishes compensation plan: 15 million CRM tokens (1.5% of total hard-cap) allocated from team reserves, distributed via 12-month linear vesting starting August 1, 2022. Affected pool users may withdraw 84% of assets immediately.
August 2022
First monthly CRM compensation token unlock for affected liquidity providers.
October 2022
Crema Finance submits revised codebase to SlowMist for a new smart contract security audit ahead of planned re-launch.
May 2025
Protocol remains nominally live with a TVL of approximately $124,000 and near-zero daily trading volume, indicating severe user attrition since the 2022 exploit.
Decision Log
- slot 455365015 · hash 9wFUkTjkYmzg4yASqR59UQQqBCKTMB894f4Uj1WfiJer
- slot 422554239 · hash GuRNxpn4ubZdB3HyHo28YGK9aXEdKV5pYLn6zb4FKgor
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 14 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:49 AM
last updated: 10/10/2026, 6:45:12 PM
4 viewsavoid.net — verified advice for a post-truth world