Alpha Homora v2 was exploited via a complex multi-protocol flash loan attack through Cream Finance's Iron Bank, draining $37.5M.
The attacker exploited a vulnerability in Alpha Homora v2's interaction with Cream Finance's Iron Bank credit line. Using a flash loan, they manipulated Alpha Homora's debt accounting to repeatedly borrow far more than allowed, ultimately draining $37.5M from Iron Bank pools. The exploit required precise understanding of how Alpha Homora and Iron Bank tracked debt positions.
Stolen funds converted and moved through Tornado Cash in batches. Alpha Finance and Cream Finance teams negotiated with the attacker on-chain. Approximately $25M was never recovered. The incident permanently damaged the relationship between the two protocols. PeckShield and CertiK traced fund flows to Tornado Cash deposits.
0x7c48b2a26fe87d46ae1a86e286a7e9a34b7d19af918e94a1d4e862f6c0f72453