$1.75M ETH From 2021’s Cream Finance Exploit Swapped To BTC on Monday and 531 BTC Remain Unspent

Exploiters involved in the infamous Cream Finance exploit from last year traded nearly 1000 ETH, worth $1.75 million, for 80 renBTC through a new transaction on Monday. Later, the renBTC was burned on the Ethereum blockchain and the corresponding BTC amount was transferred out of Ren Project’s main BTC address.

RenBTC is an ERC-20 token based on the Ethereum network that is linked to Bitcoin. It tends to hold a similar value of the Bitcoin so that 1 renBTC can be traded for one Bitcoin at any time.

The Cream Finance lending protocol was a target of multiple exploits since launch but the most severe took place on October 27th 2021. The exploiter removed nearly $130m worth of tokens from Cream Finance. An incident that created an angry reaction on Twitter, with many claiming the people behind the project incompentent.

When smart contracts have flaws, it’s popular among exploiters to take advantage of profitable arbitrage opportunities by using flash loans to quickly borrow large sums of money without having to put up any collateral.

According to the Cream Finance team, the exploiters incorporated a mix of economic and oracle exploits to inflate the value of yUSD artificially. When the price per share increased, the exploiters’ borrow limit was made large enough to steal most of the liquidity from the platform’s Ethereum v1 markets.

The exploiters have since moved funds through 16 addresses on Ethereum and then bridged the funds cross chain to Bitcoin using the Ren gateway.

Of these 16 there are 5 Ethereum addresses that combined hold cryptocurrency, tokens and LP tokens (NFTs) worth $32.64m based on current exchange rates.

Stolen Fund Activity

Since the exploit and over the course of almost a year, the exploiter has sent about 1380.78 BTC cross chain to 9 BTC addresses. The latest of which took place on 11th September when the exploiter swapped 1000 ETH for 80.74 BTC.

7 of the 9 addresses have since laundered the funds through several new addresses and sent to a lot of known entities.

1 of the 9 addresses belonged to TradeOgre where about half the funds sent to Bitcoin have ended up.

Transaction mapping of the Cream Finance exploit proceeds

The identity of the exploiters remains undiscovered and over 531 BTC remain unspent, moving on a daily basis in their possession.