The Debt-Share Rounding Bug That Drained $37.5M From an Unannounced Alpha Homora Pool

An attacker made off with roughly $37.5 million by exploiting a debt-accounting flaw in Alpha Homora's vaults, using a chain of transactions elaborate enough that much of the community initially assumed Cream Finance's Iron Bank — rather than Alpha Finance — had been the party that lost funds. That confusion was itself a symptom of how tightly the two protocols' code had become linked, and it left onlookers unsure who was actually owed restitution.

The core trick was a contract that tricked Alpha Homora into treating a malicious position as one of its own trusted internals, letting the attacker manipulate the protocol's internal debt bookkeeping. Because the vulnerable contract had not yet been publicly announced or exposed through the UI, no ordinary user held a position in it at the time — this was, in effect, a contest between the protocol and a single attacker rather than an event that put user funds at direct risk. Alpha Finance stated early on that it had identified a "prime suspect", language rarely used this directly by a protocol describing its own exploiter.

Asked why the vulnerable contract was live on mainnet before launch, Alpha Finance told rekt: "We launched several pools e.g. sUSD on the contract level and not the UI because we were preparing to launch new pools including sUSD that coming week."

01Capital flight during the confusion

As the situation unfolded, large holders moved quickly to protect themselves. Sam Bankman-Fried pulled $400 million in FTT out of Cream Finance, and Three Arrows Capital transferred over $3 million worth of ALPHA to Binance — a move that, in context, could only have been preparation to sell.

Every token associated with the incident lost value that day: Alpha Homora's governance token ALPHA slid from $2.25 to $1.78; Cream's governance token CREAM fell from $288.32 to $193.51; and AAVE — the protocol whose flash-loan primitive underpins so many exploits of this kind — dropped from $518 to a same-day low near $492.

02What the exploit actually required

Alpha Finance's own post-mortem laid out, in granular detail, exactly what conditions had to align for the attack to work — and the list points fairly directly at insider knowledge:

• HomoraBankV2 already had an sUSD pool configured at the contract level ahead of a planned release, something visible nowhere in the UI and never publicly announced.
• That sUSD lending pool held no liquidity yet, which meant the attacker could freely inflate both the total debt amount and the total debt share without resistance.
• A rounding error existed in the borrow function's math, but it only manifested when the attacker was the pool's sole borrower.
• The resolveReserve function — designed to route revenue to the protocol's reserve, and callable by anyone — could increase total debt without a corresponding increase in total debt shares.
• HomoraBankV2 would accept any custom "spell" (its term for a Yearn-style strategy), so long as the collateral-to-borrow invariant held.

Given how specific and unpublicized these conditions were, Alpha Finance suggested the attacker likely had some form of inside knowledge, though with multiple protocols and audit firms having touched the code, exactly whose knowledge remained unclear. rekt declined to name names, noting only that it would watch how Alpha Finance chose to handle the matter.

03Reconstructing the attack, step by step

Based on Alpha Finance's post-mortem, the sequence ran as follows:

1. The attacker deployed a malicious "spell" contract, functioning like a Yearn strategy. (tx)
2. In one transaction, the attacker swapped ETH for UNI and supplied both to Uniswap for an ETH/UNI LP token, while separately swapping ETH for sUSD and depositing that sUSD into Cream's Iron Bank to receive cysUSD. (tx)
3. Using the malicious spell, the attacker called execute on HomoraBankV2 to open position 883: borrowing 1000e18 sUSD and depositing the UNI-WETH LP into WERC20 as collateral, satisfying the collateral-versus-borrow check. Because the attacker was the pool's first borrower, this created exactly 1000e18 sUSD in debt shares. (tx)
4. Calling execute again on the same position, the attacker repaid 1000000098548938710983 sUSD against an actual accrued debt of 1000000098548938710984 sUSD — one unit short — leaving a debt of just 1 minisUSD tied to a single remaining debt share. (tx)
5. The attacker then triggered resolveReserve on the sUSD bank, which added 19,709,787,742,196 to total debt while total shares stayed frozen at 1 — leaving the pool with total debt of 19,709,787,742,197 against a single share. (tx)
6. Over 16 further calls to execute, each borrow of 19,709,787,742,196 minisUSD doubled the total debt while landing one unit under the new total each time, so the corresponding borrow share rounded down to zero — registering as no debt at all. By the end of this run the attacker had deposited 19.54 sUSD into Cream's Iron Bank. (tx)
7. The same doubling pattern continued for 10 more iterations, ending with 1,321 sUSD deposited into Cream's Iron Bank. (tx)
8. The attacker took a 1,800,000 USDC flash loan from Aave, converted it to 1,770,757.56254472419047906 sUSD, and deposited that into Cream to fund further borrowing via the custom spell — continuing to double the sUSD borrow across roughly ten steps from about 1,322.70 sUSD up to 677,223.15 sUSD. Some of that sUSD (1,353,123.59) was then swapped for 1,374,960.72 USDC on Curve, and 426,659.27 USDC was borrowed from Cream against the sUSD already on deposit. (tx)
9. Step 8 was repeated at roughly 10x scale using about 10 million USDC, this time without a final USDC borrow. (tx)
10. That same 10 million USDC pattern was repeated once more, again without a closing USDC borrow. (tx)
11. The attacker borrowed 13,244.63 WETH plus 3.6 million USDC, 5.6 million USDT, and 4.26 million DAI, supplied the stablecoins to Aave to receive aTokens (protecting the USDC and USDT from being frozen), then deposited the resulting aDAI, aUSDT, and aUSDC into Curve's a3Crv pool. (tx)
12. The a3Crv LP token received from that deposit was staked in Curve's liquidity gauge. (tx)
13. Remaining transactions routed funds through Tornado Cash and Gitcoin Grants, and 1,000 ETH each was sent to the deployer addresses belonging to Cream and Alpha respectively.

04Reactions from the wider DeFi community

The episode drew particular attention because of how openly the victim assigned blame. Andre Cronje, whose Yearn had partnered with Alpha Homora only weeks before the incident, wrote that the exploit spanned 9 transactions and 4 distinct manipulations, including one built around a precise debt calculation — work he said would have taken research teams hours to reconstruct, and which Alpha moved to contain within minutes of discovery. Banteg replied that the setup was "absolutely insane," arguing no one casually reviewing the contracts — particularly the unpublished portions — could plausibly have found it unassisted.

Some observers speculated the episode could precede another Yearn-related acquisition, noting that Cronje's name appears four times in Alpha's post-mortem and that the pattern felt familiar.

Whether Alpha Finance ultimately goes public with its accusations against its "prime suspect" remained an open question at the time of writing. What the post-mortem made clear is that the list of people who could plausibly have known about an unannounced, unliquidated sUSD pool was short — and the incident added to a growing unease within DeFi about how much insider access sits behind protocols built, in theory, on trustless code.