It looks like there is two hackers involved in the CREAM Finance attack.

I been doing some research on the hack and after reading countless tweets and technical reports I have come to the conclusion that there is a high probability that there were two hackers involved. This is what leads me to believe it:

1) there are two accounts associated with the hack

2) since the first day of the attack, each account holds an even amount. Eve today when they moved over 700eth, each account is evenly split so is likely they are splitting profit.

I also just read this article by Valid Network and it seems interesting the way they manipulated the price oracle

https://valid.network/post/what-just-happened-to-cream-finance-the-long-lasting-effect-of-security-vulnerabilities-in-defi