June 15, 2021

Alpha Finance Exploited in $37.5 Million Attack

3 min read

An assailant targeted DeFi protocol Alpha Finance for a sum of $37.5 million earlier this morning. The exploit was discovered in the procedure’s Alpha Homora V2 item—– not Cream Finance, as lots of believed.

Another DeFi Exploit

The DeFi space has actually suffered yet another attack.

This time, it involved Alpha Finance. Though complete information are yet to surface, it appears that the make use of affected the protocol’s Alpha Homora V2 item.

Initially, members of the DeFi community pointed to Cream Finance as the root cause of the event, though the Cream team validated that its contracts were “& ldquo; operating as normal.” & rdquo; Alpha Homora integrates Cream, which led to confusion.

Alpha Finance then published their own announcement, pointing to the Alpha Homora V2 item as the make use of’s origin. They verified that they’re working with Andre Cronje and Cream Finance to examine the occurrence, and that the loophole had been repaired. They also said that they “& ldquo; have a prime suspect” & rdquo; in mind.

Borrowing from Alpha Homora V2 has also been stopped briefly.

An Etherscan transaction reveals that the attack was worth over $37.5 million. A big piece of that amount was a loan of 13,244 ETH.

Source: Etherscan A path of activity reveals that they sent out some ETH through Tornado.cash, a personal privacy service that assists Ethereum users conceal their transaction history. They also appear to have actually sent 1,000 ETH to both the Alpha Finance Lab deployer and Cream Finance deployer.

The attack was performed through a complex multi-step procedure that suggests the perpetrator was a skilled DeFi local. They utilized the Alpha Homora procedure, which integrates Cream, to obtain sUSD. They then lent these funds back to Iron Bank to get cySUSD. They also took out large flash loans from Aave to increase their cySUSD holdings. With that, they were able to obtain the 13,244 ETH, $4,263,139 worth of DAI, $3,997,921 worth of USDC, and $5,647,242 worth of USDT.

They transferred some funds to Aave, 1,000 ETH to Iron Bank and Alpha Homora, and sent out 320 ETH to Tornado.cash. That leaves just under 10,925 ETH in their wallet, worth roughly $20 million. Their funds can be viewed on Etherscan. They did it all for a deal fee of 0.67 ETH, around $1,274.

The native tokens of both Cream Finance and Alpha Finance have actually tanked following the news. ALPHA has been particularly hard hit—– it’s down 22% at the time of composing, trading at $1.82.

Complete information surrounding the attack are yet to emerge. Both Cream Finance and Alpha Finance have verified that they’ll share post-mortem reports quickly.

Alpha Finance is among DeFi’s leading protocols, along with Cream Finance. The attack is yet another case research study that reveals DeFi is still in its nascent phases. As such, experimenting with this technology is highly dangerous.

Editor’s note: This is a developing story. More updates will be posted as they come.

Disclosure: At the time of composing, the author of this story owned ETH, ALPHA, and AAVE.