Alpha Finance / Alpha Homora (2021) — Crypto Hack
LaunderedAlpha Homora v2 was exploited via a complex multi-protocol flash loan attack through Cream Finance's Iron Bank, draining $37.5M.
Summary
Alpha Homora v2 was exploited via a complex multi-protocol flash loan attack through Cream Finance's Iron Bank, draining $37.5M.
How It Was Compromised — DeFi via Flash Loan
The attacker exploited a vulnerability in Alpha Homora v2's interaction with Cream Finance's Iron Bank credit line. Using a flash loan, they manipulated Alpha Homora's debt accounting to repeatedly borrow far more than allowed, ultimately draining $37.5M from Iron Bank pools. The exploit required precise understanding of how Alpha Homora and Iron Bank tracked debt positions.
Fund Flow & Laundering Analysis
Stolen funds converted and moved through Tornado Cash in batches. Alpha Finance and Cream Finance teams negotiated with the attacker on-chain. Approximately $25M was never recovered. The incident permanently damaged the relationship between the two protocols. PeckShield and CertiK traced fund flows to Tornado Cash deposits.