DeFi Protocols Cream Finance, Alpha Exploited in Flash Loan Attack; $37.5M Lost

Decentralized finance protocols (DeFi) Cream Finance and Alpha Finance were victims of one of the largest flash loan attacks ever Saturday morning resulting in a loss of funds totaling $37.5 million, according to transaction details on Etherscan.

Two hours later Cream said its contracts were “functioning as normal” and markets had been enabled.

Alpha Finance then posted its own announcement, saying its Alpha Homora V2 product as the root cause. They confirmed that they’re working with DeFi guru Andre Cronje and Cream Finance to investigate the incident, and that the loophole had been fixed. They also said that they “have a prime suspect” in mind.

 Earlier, Cream Finance tweeted an update on the incident saying that asset borrowing from its recently launched Iron Bank lending feature had been suspended. That tweet has since been deleted.

This is the second attack on a defi protocol in the last two weeks. Cronje’s Yearn Finance suffered an an exploit in one of its DAI lending pools, according to the decentralized finance (DeFi) protocol’s official Twitter account.  That exploit drained $11 million.

This story is developing and will be updated.