Alpha Homora exploited for $37.5M

DeFi • February 13, 2021, 9:32AM EST
The Block

Leverage liquidity protocol Alpha Homora was the victim of a $37.5M exploit on Saturday.

The exploit involved the use of CREAM Finance's Iron Bank service, which gives out uncollateralized loans to trusted smart contracts. In Saturday's hack, an exploiter coded a contract that tricked Alpha Homora into believing it is their own contract. The exploiter then used this privileged access to trick CREAM Finance into lending out $37.5M worth of ETH and stablecoins.

To get a credit line from the Iron Bank, a user must have one of the following three backstops to ensure debt is paid back:

  1. A treasury large enough to cover credit
  2. Has a Cover Protocol insurance large enough to cover credit
  3. Has a Nexus Mutual l insurance large enough to cover credit

Alpha Homora's treasury currently holds $1.6B worth of ALPHA tokens. It is unclear whether this treasury will be used to pay off the debt.

According to Alpha Homora, the loophole that caused the exploit has been patched and the team is working with Yearn founder Andre Cronje and CREAM Finance to investigate the stolen funds and "have a prime suspect already."