Alchemix alETH vault hack — June 2021

On 16 June 2021 users of Alchemix's newly launched alETH vault found their loans showing as fully repaid. They withdrew their ETH collateral while keeping the alETH they had borrowed, leaving the vault under-collateralised.

There was no attacker in the conventional sense and no unauthorised access. A deployment-script error accidentally created extra alETH vaults, and the protocol then calculated debts against the wrong vault, applying protocol funds to user debt so that loans appeared repaid. Anyone who then withdrew took back collateral the protocol had effectively paid off on their behalf. Alchemix paused alETH borrowing while it investigated and published an incident report. Losses were limited by an existing 2,000 alETH borrowing cap. Alchemix's own incident report describes the mechanism more precisely, as the transmuter's harvest function being called with the wrong vault index and sending roughly 4,300 ETH of phantom revenue to the adapter contract; that detail appears only in the forum post.

The size of the shortfall is reported inconsistently. CoinDesk's early account put it near 2,000 ETH, about $4.8 million. The Defiant reported 2,688 ETH, valuing that at roughly $6.4 million on the day, while Cointelegraph used $6.5 million.

Alchemix said no user lost funds and that it would cover the gap through a temporary increase in protocol fees, an ETH injection from its treasury and the sale of treasury DAI, alongside a redeployed vault. It also asked those who had withdrawn to return the excess voluntarily in exchange for future rewards. The proportion actually returned was not disclosed.