What happened
DNS hijacking was discovered at Cream Finance. Their GoDaddy account was hacked, and users were redirected to a phishing website.
Incident timeline:
- The website was down; users reported a website outage
- GoDaddy DNS CNAME record not pointing to their hosting IP, consistent with the website outage
- DNS A record was updated to the correct IP; root cause analysis began
- Noticed DNS cache pollution, consistent with user reports; Began DNS migration to Cloudflare
- Discovered that GoDaddy login credentials were compromised and could not log in
- CoinGecko, CoinMarketCap, and imToken were notified to update the website link and put up warning messages
- Two alternative websites were put for users to continue using Cream Finance
- The ownership of the domain was reclaimed with the help of GoDaddy, started to recover the service and ensure the security
- The website returned to normal, while some regions were still affected as DNS propagation continued
Case & protocol details
Classification
Exchange (DEX),Borrowing and Lending
Protocol Type
Exploit/Other
Affected asset / contract
CREAM
Official Website
cream.finance/
Protocol Twitter/X
@CreamdotFinance
Evidence & learning
Sources and on-chain records
- report Post-mortem medium.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.