Debt-Forgiveness Bug Leaves Alchemix Owing Millions in ETH

Alchemix has published a post-mortem detailing a bug in its newly added ETH collateral system that inadvertently let users withdraw collateral without ever incurring the debt meant to back it.

The protocol's original design let users deposit DAI and borrow against it in alUSD, a loan sized to the future yield their deposit was expected to generate; as that yield accrued over time, it automatically paid down the loan. When the team extended the same mechanic to Ether deposits — minting alETH against ETH collateral — a flaw meant that some users who deposited ETH and minted alETH were assigned no offsetting debt at all. That let them keep the alETH they had minted while also withdrawing the ETH that was supposed to remain locked as collateral.

Once alerted that some of its own users were exploiting the flaw, the Alchemix team reacted quickly, pausing new alETH minting while it investigated. The bug left alETH undercollateralized by roughly 2,700 ETH — about $6.5M at the time — a shortfall the protocol itself is now on the hook to make up, and it has publicly asked affected users to voluntarily return the funds to help close the gap.

Rekt spoke with Alchemix co-founder Scoopy Trooples about the incident and the odds that the appeal for returned funds would succeed.

Two days after the bug surfaced, Scoopy described the period as stressful but said the team had drawn strength from support across the DeFi community and beyond; he emphasized that no user actually lost funds in the episode and that the team intends to apply an even greater degree of caution across its operations going forward, noting that protocols rarely get a third chance after burning through a second one.

Asked about running a protocol that carried over $1B in TVL at the time of the incident, Scoopy said the responsibility that comes with that scale is considerable. The team's first move on discovering the issue was to pause the affected contracts; what followed, he said, was a tense period working through the root cause in what he described as a "war room," with real relief once they confirmed user funds were ultimately safe — even though a large amount of work remained to actually fix things.

On the voluntary return program, Scoopy said the team had heard plenty of verbal commitments from community members but had not yet launched the mechanism itself; a portal was expected on the Alchemix app within a few days to let users send back ETH or alETH obtained through the bug. He said the team was still weighing options for covering whatever portion isn't returned voluntarily, and planned to factor in community feedback before settling on a final approach.

Asked who had benefited from the bug, Scoopy clarified that it effectively touched anyone who had borrowed alETH, since the flaw wiped out all associated debt — meaning even users with no intention of exploiting the situation ended up in that position regardless.

On the financial fallout, Scoopy explained that if more than 25% of the missing funds are voluntarily returned, the roughly $4M non-ALCX portion of the protocol's treasury would be enough to cover the remainder, though it would still mean scaling back hiring and marketing ambitions for some time; the team expects to recover given its overall cash flow. If the voluntary response falls short of that threshold, he said Alchemix would look at further measures, noting the team had already received offers of help from elsewhere in the industry. Closing out the interview, Scoopy said the team was running an internal review aimed at eliminating similar mistakes and thanked the DeFi community for its support.

The overall tone from Alchemix suggests confidence that the protocol can absorb the debt and keep building. That confidence appears partly rooted in community goodwill: despite the embarrassing nature of the incident, some users never lost faith in the project — one user, for instance, took funds obtained through the bug and reinvested them straight back into Alchemix. Whether the broader community ultimately returns the needed 25% of funds, or whether Alchemix has to find another way to cover the shortfall, remains an open question.