Tranche Vault on Avalanche Drained of 1.01 Million USDC

An attacker drained 1.01 million $USDC from a Tranche Vault on Avalanche that security firm Blockaid linked to Fence Finance and Valinor Digital, leaving the identified contract with no $USDC, according to onchain records.

Snowtrace records show the vault transferred 1,013,353.61 $USDC to the attack contract at 8:00 p.m. ET on Oct. 27. That contract then forwarded the funds to the wallet Blockaid identified as the exploiter.

“An attacker used a flash loan to mint inflated tranche shares, then redeemed the vault's remaining $USDC,” Blockaid wrote in its alert, describing the exploit as ongoing.

A flash loan provides temporary capital that must be repaid within the same transaction. In the sequence Blockaid described, the loan supplied the capital to mint the inflated shares, which were then used to withdraw $USDC from the vault.

Token-transfer records show an earlier transaction, at 7:56 p.m. ET, sent the same amount of $USDC into and back out of the vault. Across that transaction and the later cash-out, the net vault outflow was 1,013,353.61 $USDC, according to The Defiant's calculation.

No $USDC Left for Withdrawals

Whether the vault has been paused or the flaw fixed was unconfirmed at publication.

A subsequent onchain balance check returned zero $USDC for the victim address, 0xE25CB545Bdd47a8Ec2d08001cb5661B00D47621a. That leaves the contract without $USDC on hand to meet withdrawals.