Alchemix V2
Summary
Alchemix V2 is a DeFi self-repaying loan protocol on Ethereum that allows users to borrow synthetic assets (alUSD, alETH) against yield-bearing collateral, with loans auto-repaid by yield generated from underlying deposits. The protocol experienced two notable security incidents: a June 2021 smart contract bug in the alETH vault that allowed users to withdraw collateral without repaying loans (the 'reverse rug pull,' ~$6.5M shortfall), and an indirect July 2023 exploit via a Vyper compiler vulnerability in a Curve liquidity pool (~$13.6M drained, later fully returned). In both cases, the Alchemix team responded promptly and took active steps to restore protocol solvency, distinguishing it from many exploited DeFi protocols.
Connected Entities
1 entities · 10 linked investigations- + 1 more
Timeline(11 events)
2021-02-01
Alchemix V1 protocol launches on Ethereum mainnet with alUSD synthetic stablecoin and Yearn vault integrations.
2021-06-13
Alchemix launches the alETH vault, introducing ETH as collateral for synthetic loans.
2021-06-16
A deployment bug in the alETH vault is discovered: incorrect vault array indexing causes borrower debts to be incorrectly forgiven. Users begin withdrawing collateral without repaying loans. Approximately $6.5 million (2,688 ETH) shortfall results. ALCX falls ~21.5%. The team pauses alETH minting within ~15 minutes of beginning investigation.
CoinDesk / CoinTelegraph2021-06-17
Alchemix publishes post-mortem, publicly asks users to voluntarily return excess ETH/alETH, offering 1 ALCX per 1 ETH returned and a special NFT for full repayment. Team increases protocol fees and sells DAI from treasury to restore collateralization.
The Defiant / CoinTelegraph2021-06-30
More than half of the $6.5M shortfall reportedly recovered through voluntary user returns.
2021-11-01
Runtime Verification begins formal seven-week audit of Alchemix V2 core smart contracts.
2022-01-13
Runtime Verification delivers Alchemix V2 audit report. 3 High, 11 Medium, 14 Low issues identified; all High and Low and 9 of 11 Medium issues resolved.
Runtime Verification / Alchemix Medium2022-05-01
Alchemix V2 launches with expanded yield strategies (Vesper, AAVE vaults) and user-selectable collateral types. Code4rena audit competition also conducted.
2023-07-30
Vyper compiler vulnerability exploited across multiple Curve Finance pools. Alchemix alETH-ETH pool drained of 4,821 alETH and 7,258 ETH (~$13.6M). Alchemix team immediately begins emergency liquidity removal.
Alchemix Medium Post-Mortem2023-08-03
Alchemix, Curve, and Metronome publicly offer exploiter 10% bounty in exchange for returning 90% of funds by August 6, pledging no legal action.
Fortune / CoinTelegraph2023-08-05
Exploiter returns all stolen alETH and ETH to Alchemix over multiple transactions. Full fund recovery confirmed.
CoinTelegraph / Yahoo FinanceDecision Log
- hash: 22yZZzVqVAmBceArUBtEPNYNdb2agFP7h5FsA1qi9iN3
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:56 AM
last updated: 5/28/2026, 5:55:22 PM
avoid.net — verified advice for a post-truth world