Crema Finance Exploit

Crema Finance was exploited on 02–03 July 2022 via flashloans that abused a spoofed tick account and flaws in claim()/WithdrawAllTokenTypes() handling, resulting in roughly $8.78M drained (including ~69k SOL and assets bridged as ~6,064 ETH to 0x8021…). The team suspended the contract, initiated an investigation, and offered an $800k bounty with a 72-hour deadline, but the attacker’s on-chain behavior suggests they will not return the funds.