On August 30, 2021, CREAM Finance suffered a reentrancy attack losing 418M AMP tokens and 1,308 ETH (~$18.8M). Using a 500 ETH flash loan as seed capital, the attacker exploited a reentrancy vulnerability in the AMP token callback handler to self-liquidate and withdraw more collateral than deposited.