Cream Finance Hack

On 15 March 2021, an attacker hijacked the DNS for Cream Finance's website. The attacker had gained access to Cream's GoDaddy account, which managed the domain's DNS, and changed the records to point at attacker-controlled servers. Visitors to the real Cream domain were shown a phishing copy of the site whose pop-ups asked for their 12-word wallet seed phrase or private key. Anyone who entered it would hand over full control of that wallet.

PancakeSwap was hit the same day in the same way. Its DNS was also managed at GoDaddy, and the records for both sites changed within about a minute of each other, which points to a single attacker.

Cream warned users on Twitter that its DNS had been compromised by a third party and that it would never ask for private keys or seed phrases. Cream's post-mortem says the site first went down, then the team found its GoDaddy CNAME record no longer pointed to its hosting and that the GoDaddy login credentials had been compromised, locking the team out. Cream moved DNS to Cloudflare and asked CoinGecko, CoinMarketCap and imToken to update links and show warnings. It put up two alternative websites and recovered the domain with GoDaddy's help. Service came back as DNS changes propagated.

The smart contracts were not touched. The risk was to users who typed their seed phrase into the fake site. No total amount stolen from Cream users has been published.