Flash-Loan Attacker Drains $1.01M in USDC From Avalanche Tranche Vault

An attacker drained approximately $1.01 million in $USDC from an Avalanche-based Tranche Vault on the evening of Oct. 27, according to an incident alert from security firm Blockaid ¹. The exploit relied on flash loans to distort the vault's accounting before extracting its stablecoin holdings across roughly two transactions ¹. At the time of writing, native network asset $AVAX traded at $8.79.

According to Blockaid, the perpetrator leveraged an uncollateralized flash loan to mint inflated tranche shares ¹. The attacker subsequently redeemed those artificial shares against the vault's reserves to siphon the deposited stablecoins ¹. Blockaid, which previously highlighted that illicit actors hold significant funds beyond administrative freeze capabilities (as detailed in an analysis of unfreezable stolen crypto), framed the estimated $1.01 million loss as a running figure and warned that the incident remained active ¹.

Unclear Operator and Protocol Status

Blockaid linked the impacted contract to digital asset firms Valinor Digital and Fence, tagging both entities on social platform X ¹. However, the security firm did not confirm which organization directly operates the vault infrastructure, and neither firm issued an immediate public comment regarding the exploit ¹.

It remains undetermined whether administrators have paused the underlying smart contracts, whether any lost funds remain recoverable, or how many depositors suffered direct losses ¹. The incident adds to historical flash-loan vulnerabilities on the Avalanche blockchain, including the February 2023 exploit of stablecoin platform Platypus, which lost $8.5 million to solvency-check manipulation ¹.