{"investigation":{"slug":"alpha-finance","entity_name":"Alpha Finance Lab","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"Alpha Finance Lab (later rebranded to Alpha Venture DAO, then Stella) is a DeFi protocol best known for its leveraged yield farming product Alpha Homora. On February 13, 2021, Alpha Homora V2 was exploited for approximately $37.5 million via a sophisticated attack that required insider knowledge of an unannounced smart contract, draining funds from its Iron Bank (Cream Finance) integration. By March 2023, the protocol had repaid less than 2% of the resulting $32 million debt to Iron Bank despite a formal repayment agreement, triggering a second crisis in which user funds were frozen.","sections":[{"content":"On February 13, 2021, an unknown attacker exploited Alpha Homora V2 across a series of at least nine transactions, draining approximately $37.5 million in ETH and stablecoins from the Iron Bank — the protocol-to-protocol undercollateralized lending facility operated by Cream Finance. The stolen funds consisted of approximately 13,244 ETH plus USDC, USDT, and DAI. The attacker used a custom malicious 'spell' contract (address 0x560a8e3b79d23b0a525e15c6f3486c6a293ddad2) deployed specifically for the exploit. Four chained vulnerabilities were required to execute the attack: (1) an undisclosed sUSD lending pool that existed only at the contract level and had not been announced or made accessible via the Alpha Homora UI; (2) zero liquidity in that sUSD pool, allowing the attacker to manipulate total debt amounts; (3) a rounding miscalculation in the borrow function that only affected the sole borrower; and (4) a resolveReserve function callable by any external address that could inflate totalDebt without increasing totalDebtShare. The attack allowed the attacker to borrow from Iron Bank at effectively zero cost using manipulated sUSD debt. After extracting the funds, the attacker transferred 1,000 ETH each to the Alpha Homora and Iron Bank deployer addresses and moved approximately 320 ETH through Tornado.cash. Yearn co-founder Andre Cronje stated: 'Nine transactions. Four different manipulations. One including an exact debt calculation. This took teams of researchers hours to figure out.' Banteg added: 'No way this could be found by someone casually looking at the contracts.' The debt accrued from this event was protocol-to-protocol — between Alpha Homora V2 and Cream V2 Iron Bank — and not directly between individual users and Alpha Homora. Alpha Finance stated the loophole was patched immediately after discovery.","heading":"February 2021 Iron Bank Exploit","sources":[{"url":"https://www.coindesk.com/markets/2021/02/13/defi-protocols-cream-finance-alpha-exploited-in-flash-loan-attack-375m-lost","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-alpha-homora-defi-hack-feb-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://rekt.news/alpha-finance-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://blog.alphaventuredao.io/alpha-homora-v2-post-mortem/","name":"blog.alphaventuredao.io","type":"other","credibility":3},{"url":"https://medium.com/cream-finance/alpha-homora-v2-exploit-post-mortem-344d277bdea6","name":"medium.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/slowmist-an-analysis-of-the-attack-on-alpha-finance-cream-exploit-723c536c36b8","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/alpha-homora-loses-37-million-following-iron-bank-exploit","name":"cointelegraph.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The sophistication of the February 2021 exploit and the attacker's apparent foreknowledge of an unannounced internal contract generated substantial community concern about potential insider involvement. Alpha Finance had deployed an sUSD lending pool on the HomoraBankV2 contract in preparation for an upcoming public release, but the pool had not been disclosed, announced, or made available via the protocol UI. The attacker's ability to locate and exploit this undisclosed pool led multiple commentators — including Yearn co-founder Andre Cronje — to conclude that insider knowledge was almost certainly required. Alpha Finance publicly stated they had identified 'a prime suspect' in their investigation but declined to name any individual. The post-mortem acknowledged that a wide range of parties had access to internal contract information, including team members, auditors, and integrated protocol teams, making the source of any potential information leak difficult to isolate. No charges or confirmed attribution were ever publicly disclosed. The insider knowledge allegations remain unresolved and unproven, but were sufficiently credible to be reported by major outlets including CoinDesk and Rekt News.","heading":"Insider Knowledge Allegations","sources":[{"url":"https://rekt.news/alpha-finance-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://nodesblock.com/news/review-of-the-37-5-million-theft-of-alpha-finance-hackers-have-inside-information/","name":"nodesblock.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2021/02/13/defi-protocols-cream-finance-alpha-exploited-in-flash-loan-attack-375m-lost","name":"coindesk.com","type":"other","credibility":3},{"url":"https://blog.alphaventuredao.io/alpha-homora-v2-post-mortem/","name":"blog.alphaventuredao.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Alpha Finance Lab and Cream Finance reached a formal debt repayment agreement. Alpha Homora V2 committed to diverting 20% of V1 and V2 protocol fee reserves on a monthly basis to Iron Bank until the full $32.4 million debt was repaid. As additional security, Alpha Finance locked 50 million ALPHA tokens in a time-locked escrow contract controlled by Cream's multisig — valued at approximately $90–109 million at the time of the agreement. By March 2023 — roughly two years after the exploit — Alpha Homora had repaid only approximately $481,746 of the debt, representing less than 1.6% of the total obligation. The outstanding balance as of March 2, 2023 was $31,947,429 (denominated as 11,422 ETH, 3,106,549 DAI, 3,851,025 USDC, and 6,212,087 USDT). Concurrently, the ALPHA token's market value had collapsed by over 90% from its post-exploit highs, reducing the value of the posted collateral to approximately $6 million — far below the outstanding debt. On March 1, 2023, Iron Bank unilaterally froze Alpha Homora user lending accounts by modifying smart contract configuration, preventing users from withdrawing their deposits. Iron Bank issued a three-day ultimatum demanding supplemental collateral or full repayment, threatening to seize user funds to offset the exploit debt. Alpha Homora responded with an open letter proposing that Iron Bank retain approximately $32 million in user funds to settle the debt and return roughly $8.7 million in excess user deposits. After over two months of failed negotiations, Alpha Homora depositors voted to cease negotiations with Iron Bank, accept goodwill compensation from Alpha Homora, and pursue legal action to recover the frozen funds. No public announcement of a definitive legal or financial resolution has been confirmed as of the date of this investigation.","heading":"Debt Repayment Failure and 2023 Iron Bank Crisis","sources":[{"url":"https://rekt.news/iron-alpha","name":"rekt.news","type":"other","credibility":3},{"url":"https://medium.com/cream-finance/joint-announcement-on-funds-repayment-a7d63870f7d6","name":"medium.com","type":"other","credibility":3},{"url":"https://blog.alphaventuredao.io/joint-announcement-on-funds-repayment/","name":"blog.alphaventuredao.io","type":"other","credibility":3},{"url":"https://www.theblock.co/post/216536/iron-bank-freezes-alpha-homora-lending-accounts-over-bad-debt-dispute","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.theblock.co/post/216832/iron-bank-tells-alpha-homora-to-take-ownership-of-its-bad-debt","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/defi-partners-clash-over-32m-bad-debt-iron-bank-alpha-homora/","name":"dlnews.com","type":"other","credibility":3},{"url":"https://blog.alphaventuredao.io/an-open-letter-to-iron-bank/","name":"blog.alphaventuredao.io","type":"other","credibility":3},{"url":"https://thedefiant.io/news/defi/alpha-homora-cedes-32m-user-funds-iron-bank","name":"thedefiant.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Alpha Homora V2 underwent multiple third-party security audits prior to and following the February 2021 exploit. Pre-exploit audits were conducted by Quantstamp and PeckShield. Following the exploit, OpenZeppelin completed a post-remediation audit of Alpha Homora V2 in April 2021, finding zero critical issues and one high-severity issue. Despite these audit engagements, the four chained vulnerabilities that enabled the February 2021 exploit were not identified by any auditor before the attack, raising questions about the thoroughness of coverage — particularly for contract-level functionality that was not yet deployed to the UI. The attack demonstrated that standard audit procedures may not cover undisclosed or staged-but-unreleased contract functionality. Alpha Finance also launched a bug bounty program on Immunefi following the exploit.","heading":"Audit and Security Posture","sources":[{"url":"https://www.openzeppelin.com/news/alpha-homora-v2","name":"openzeppelin.com","type":"other","credibility":3},{"url":"https://blog.alphaventuredao.io/alpha-homora-v2-has-been-audited-by-openzeppelin/","name":"blog.alphaventuredao.io","type":"other","credibility":3},{"url":"https://blog.alphaventuredao.io/alpha-finance-lab-bug-bounty-live-on-immunefi-with-additional-bounty-from-armor/","name":"blog.alphaventuredao.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Alpha Finance Lab has undergone two significant rebrands since the February 2021 exploit. On March 31, 2022, the project rebranded from Alpha Finance Lab to Alpha Venture DAO, repositioning itself as a decentralized venture capital and builder incubator for Web3 projects. In June 2023, the project rebranded again to Stella, launching on Arbitrum with a leveraged DeFi strategy product. The ALPHA token ticker was retained through both rebrands. Core leadership remained consistent across these transitions, with Tascha Punyaneramitdee (formerly of Band Protocol and Tencent) continuing as project lead, Nipun Pitimanaaree (MIT mathematics and computer science) continuing as tech lead, and Arin in the product lead role. The serial rebranding occurred during a period when the Iron Bank debt crisis remained unresolved and the ALPHA token had declined approximately 99% from its all-time high of roughly $2.95 in February 2021.","heading":"Rebrands and Project Continuity","sources":[{"url":"https://invezz.com/news/2022/03/31/alpha-finance-lab-rebrands-to-alpha-venture-dao-to-support-decentralised-web3-innovation/","name":"invezz.com","type":"other","credibility":3},{"url":"https://blog.alphaventuredao.io/alpha-finance-lab-rebrands-expands-into-alpha-venture-dao-to-disrupt-web3-ecosystem/","name":"blog.alphaventuredao.io","type":"other","credibility":3},{"url":"https://www.kucoin.com/news/en-kucoin-supports-the-alpha-finance-lab-alpha-rebranding-20230608","name":"kucoin.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/alpha-finance-lab/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The ALPHA token was launched via Binance Launchpad on October 8, 2020, in a lottery-format sale raising $2 million USD at a token price of $0.02. The sale involved 100 million ALPHA tokens sold to 8,736 winners from 20,112 participants. The token was listed on Binance on October 10, 2020. ALPHA reached its all-time high of approximately $2.70–$2.95 in February 2021, coinciding with the period of the exploit. Following the exploit and the broader 2022 bear market, ALPHA experienced a decline of approximately 99% from its all-time high. As of 2023, the ALPHA token's depressed valuation directly contributed to the Iron Bank debt crisis by rendering the pledged 50 million ALPHA token collateral worth only a fraction of the outstanding debt.","heading":"Token Launch and ALPHA Token Decline","sources":[{"url":"https://www.binance.com/en/blog/all/Binance-Launchpad-Alpha-Finance-Lab-Sale-Results-421499824684901080","name":"binance.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/alpha-finance-lab/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://walletinvestor.com/forecast/alpha-finance-lab-prediction","name":"walletinvestor.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ZachXBT, a pseudonymous on-chain investigator known for identifying crypto fraud and rug pulls, has flagged Alpha Finance as a high-risk entity. The specific nature and timing of ZachXBT's flag on Alpha Finance are consistent with the documented series of events: the February 2021 insider-knowledge exploit, the near-complete failure to honor the debt repayment agreement over two years, the 2023 user fund freeze, and the pattern of rebranding while underlying obligations remained unsettled. No specific ZachXBT thread or report exclusively dedicated to Alpha Finance was independently located and verified for this investigation; the flag is referenced per the source of this investigation request.","heading":"ZachXBT Flag","sources":[],"severity":"medium"}],"timeline":[{"date":"2020-10-08","event":"ALPHA token launches on Binance Launchpad at $0.02, raising $2M USD from 8,736 winners.","source":""},{"date":"2021","event":"Iron Bank (protocol-to-protocol lending) is established as a spin-off of Cream Finance, enabling undercollateralized borrowing for whitelisted protocols including Alpha Homora.","source":"","date_original":"2021-01-01"},{"date":"2021-02-13","event":"Alpha Homora V2 is exploited for approximately $37.5 million via nine transactions chaining four smart contract vulnerabilities, including an unannounced sUSD pool. Funds drained from Cream Finance's Iron Bank.","source":""},{"date":"2021-02-13","event":"Alpha Finance states they have 'a prime suspect' and 'already' know the likely identity of the attacker. No name is ever publicly disclosed.","source":""},{"date":"2021-02-14","event":"Joint repayment agreement announced: Alpha Homora commits to 20% of protocol fee reserves monthly toward Iron Bank debt; 50M ALPHA tokens locked as 2x collateral in time-locked escrow.","source":""},{"date":"2021-04-09","event":"OpenZeppelin completes post-remediation audit of Alpha Homora V2, finding zero critical and one high-severity issue.","source":""},{"date":"2022-03-31","event":"Alpha Finance Lab rebrands to Alpha Venture DAO, repositioning as a Web3 builder and decentralized venture DAO.","source":""},{"date":"2023-03","event":"Iron Bank freezes Alpha Homora user lending accounts after Alpha has repaid only ~$481K of $32.4M debt over two years. ALPHA token collateral worth approximately $6M against $32M debt.","source":"","date_original":"2023-03-01"},{"date":"2023-03-02","event":"Outstanding Alpha Homora debt to Iron Bank confirmed at $31,947,429.","source":""},{"date":"2023-03-05","event":"Iron Bank deadline passes without resolution. Alpha Homora proposes Iron Bank retain ~$32M in user funds and return ~$8.7M excess.","source":""},{"date":"2023-06","event":"Alpha Venture DAO depositors vote to stop negotiating with Iron Bank and pursue legal action. Project rebrands again to Stella, launching on Arbitrum.","source":"","date_original":"2023-06-01"}],"sources_used":[{"url":"https://www.coindesk.com/markets/2021/02/13/defi-protocols-cream-finance-alpha-exploited-in-flash-loan-attack-375m-lost","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260806195625/https://www.coindesk.com/markets/2021/02/13/defi-protocols-cream-finance-alpha-exploited-in-flash-loan-attack-375m-lost","credibility":3,"archive_timestamp":"2026-08-06T19:56:25+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-alpha-homora-defi-hack-feb-2021","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260415070938/https://www.halborn.com/blog/post/explained-the-alpha-homora-defi-hack-feb-2021","credibility":3,"archive_timestamp":"2026-04-15T07:09:38+00:00"},{"url":"https://rekt.news/alpha-finance-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260415163159/https://rekt.news/alpha-finance-rekt","credibility":3,"archive_timestamp":"2026-04-15T16:31:59+00:00"},{"url":"https://blog.alphaventuredao.io/alpha-homora-v2-post-mortem/","name":"blog.alphaventuredao.io","type":"other","archive_url":"http://web.archive.org/web/20260518024141/https://blog.alphaventuredao.io/alpha-homora-v2-post-mortem/","credibility":3,"archive_timestamp":"2026-05-18T02:41:41+00:00"},{"url":"https://medium.com/cream-finance/alpha-homora-v2-exploit-post-mortem-344d277bdea6","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20260803174950/https://medium.com/cream-finance/alpha-homora-v2-exploit-post-mortem-344d277bdea6","credibility":3,"archive_timestamp":"2026-08-03T17:49:50+00:00"},{"url":"https://slowmist.medium.com/slowmist-an-analysis-of-the-attack-on-alpha-finance-cream-exploit-723c536c36b8","name":"slowmist.medium.com","type":"other","archive_url":"http://web.archive.org/web/20250909135249/https://slowmist.medium.com/slowmist-an-analysis-of-the-attack-on-alpha-finance-cream-exploit-723c536c36b8","credibility":3,"archive_timestamp":"2025-09-09T13:52:49+00:00"},{"url":"https://cointelegraph.com/news/alpha-homora-loses-37-million-following-iron-bank-exploit","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260724221457/https://cointelegraph.com/news/alpha-homora-loses-37-million-following-iron-bank-exploit","credibility":3,"archive_timestamp":"2026-07-24T22:14:57+00:00"},{"url":"https://nodesblock.com/news/review-of-the-37-5-million-theft-of-alpha-finance-hackers-have-inside-information/","name":"nodesblock.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://rekt.news/iron-alpha","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260209093747/https://rekt.news/iron-alpha","credibility":3,"archive_timestamp":"2026-02-09T09:37:47+00:00"},{"url":"https://medium.com/cream-finance/joint-announcement-on-funds-repayment-a7d63870f7d6","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20250724204904/https://medium.com/cream-finance/joint-announcement-on-funds-repayment-a7d63870f7d6","credibility":3,"archive_timestamp":"2025-07-24T20:49:04+00:00"},{"url":"https://blog.alphaventuredao.io/joint-announcement-on-funds-repayment/","name":"blog.alphaventuredao.io","type":"other","archive_url":"http://web.archive.org/web/20260518035727/https://blog.alphaventuredao.io/joint-announcement-on-funds-repayment/","credibility":3,"archive_timestamp":"2026-05-18T03:57:27+00:00"},{"url":"https://www.theblock.co/post/216536/iron-bank-freezes-alpha-homora-lending-accounts-over-bad-debt-dispute","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/216832/iron-bank-tells-alpha-homora-to-take-ownership-of-its-bad-debt","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.dlnews.com/articles/defi/defi-partners-clash-over-32m-bad-debt-iron-bank-alpha-homora/","name":"dlnews.com","type":"other","archive_url":"http://web.archive.org/web/20260617095331/https://www.dlnews.com/articles/defi/defi-partners-clash-over-32m-bad-debt-iron-bank-alpha-homora/","credibility":3,"archive_timestamp":"2026-06-17T09:53:31+00:00"},{"url":"https://blog.alphaventuredao.io/an-open-letter-to-iron-bank/","name":"blog.alphaventuredao.io","type":"other","archive_url":"http://web.archive.org/web/20260518024453/https://blog.alphaventuredao.io/an-open-letter-to-iron-bank/","credibility":3,"archive_timestamp":"2026-05-18T02:44:53+00:00"},{"url":"https://thedefiant.io/news/defi/alpha-homora-cedes-32m-user-funds-iron-bank","name":"thedefiant.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.openzeppelin.com/news/alpha-homora-v2","name":"openzeppelin.com","type":"other","archive_url":"http://web.archive.org/web/20260306111907/https://www.openzeppelin.com/news/alpha-homora-v2","credibility":3,"archive_timestamp":"2026-03-06T11:19:07+00:00"},{"url":"https://blog.alphaventuredao.io/alpha-homora-v2-has-been-audited-by-openzeppelin/","name":"blog.alphaventuredao.io","type":"other","archive_url":"http://web.archive.org/web/20260418042410/https://blog.alphaventuredao.io/alpha-homora-v2-has-been-audited-by-openzeppelin/","credibility":3,"archive_timestamp":"2026-04-18T04:24:10+00:00"},{"url":"https://blog.alphaventuredao.io/alpha-finance-lab-bug-bounty-live-on-immunefi-with-additional-bounty-from-armor/","name":"blog.alphaventuredao.io","type":"other","archive_url":"http://web.archive.org/web/20260518035431/https://blog.alphaventuredao.io/alpha-finance-lab-bug-bounty-live-on-immunefi-with-additional-bounty-from-armor/","credibility":3,"archive_timestamp":"2026-05-18T03:54:31+00:00"},{"url":"https://invezz.com/news/2022/03/31/alpha-finance-lab-rebrands-to-alpha-venture-dao-to-support-decentralised-web3-innovation/","name":"invezz.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.alphaventuredao.io/alpha-finance-lab-rebrands-expands-into-alpha-venture-dao-to-disrupt-web3-ecosystem/","name":"blog.alphaventuredao.io","type":"other","archive_url":"http://web.archive.org/web/20260608083857/https://blog.alphaventuredao.io/alpha-finance-lab-rebrands-expands-into-alpha-venture-dao-to-disrupt-web3-ecosystem/","credibility":3,"archive_timestamp":"2026-06-08T08:38:57+00:00"},{"url":"https://www.kucoin.com/news/en-kucoin-supports-the-alpha-finance-lab-alpha-rebranding-20230608","name":"kucoin.com","type":"other","archive_url":"https://web.archive.org/web/20260829202824/https://www.kucoin.com/announcement/en-kucoin-supports-the-alpha-finance-lab-alpha-rebranding-20230608","credibility":3,"archive_timestamp":"2026-08-29T20:28:24+00:00"},{"url":"https://coinmarketcap.com/currencies/alpha-finance-lab/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260725134912/https://coinmarketcap.com/currencies/alpha-finance-lab/","credibility":3,"archive_timestamp":"2026-07-25T13:49:12+00:00"},{"url":"https://www.binance.com/en/blog/all/Binance-Launchpad-Alpha-Finance-Lab-Sale-Results-421499824684901080","name":"binance.com","type":"other","archive_url":"https://web.archive.org/web/20260829200447/https://www.binance.com/en/blog/all/421499824684901080","credibility":3,"archive_timestamp":"2026-08-29T20:04:47+00:00"},{"url":"https://walletinvestor.com/forecast/alpha-finance-lab-prediction","name":"walletinvestor.com","type":"other","archive_url":"https://web.archive.org/web/20260830091927/https://walletinvestor.com/forecast/alpha-finance-lab-prediction","credibility":3,"archive_timestamp":"2026-08-30T09:19:27+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:59.045051+00:00","updated_at":"2026-09-01T04:16:58.003281+00:00"}}