---
title: "Flash-Loan Attacker Drains $1.01M in USDC From Avalanche Tranche Vault"
description: "Security firm Blockaid reported an ongoing exploit targeting a vault associated with Valinor Digital and Fence."
url: https://basisdesk.news/news/avalanche-tranche-vault-flash-loan-exploit-usdc
published: 2026-10-28T14:26:15.672Z
modified: 2026-10-28T14:26:15.672Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [USDC, AVAX]
tags: [Avalanche, Flash Loans, DeFi Exploits, USDC, Blockaid]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# Flash-Loan Attacker Drains $1.01M in USDC From Avalanche Tranche Vault

Security firm Blockaid reported an ongoing exploit targeting a vault associated with Valinor Digital and Fence.

## At a glance

- **What happened:** An attacker drained about $1.01 million in USDC from an Avalanche Tranche Vault using a flash loan on Oct. 27, according to Blockaid.
- **Why it matters:** The exploit demonstrates ongoing vulnerabilities in DeFi tranche vaults and share-minting mechanisms on Avalanche.
- **Who is affected:** Depositors in the affected Avalanche Tranche Vault, alongside associated entities Valinor Digital and Fence.
- **What's next:** No next step announced.
- **Primary source:** [Flash-Loan Attacker Drains About $1 Million in USDC From Avalanche-Based Tranche Vault](https://unchainedcrypto.com/flash-loan-attacker-drains-about-1-million-in-usdc-from-avalanche-based-tranche-vault/) — unchainedcrypto.com

## Key points

- An attacker siphoned roughly $1.01 million in USDC from an Avalanche Tranche Vault on Oct. 27, according to Blockaid.
- The exploit used flash loans to mint inflated tranche shares, which were then redeemed to drain deposited stablecoins.
- Blockaid linked the vault to Valinor Digital and Fence, though neither entity has publicly clarified operations or vault status.

## Editorial remark

- **Context:** Avalanche DeFi protocols have suffered past flash-loan exploits, including Platypus's $8.5 million loss in February 2023 caused by manipulated solvency checks.
- **Impact:** Tranche Vault depositors face potential losses exceeding $1.01 million, while contract operators risk further drainage if functions remain unpaused.
- **Watch:** Official statements or post-mortem disclosures from Valinor Digital and Fence, potential contract pause transactions, and asset tracing of drained USDC.

An attacker drained approximately $1.01 million in $USDC from an Avalanche-based Tranche Vault on the evening of Oct. 27, according to an incident alert from security firm Blockaid [1]. The exploit relied on flash loans to distort the vault's accounting before extracting its stablecoin holdings across roughly two transactions [1]. At the time of writing, native network asset $AVAX traded at $8.79.

According to Blockaid, the perpetrator leveraged an uncollateralized flash loan to mint inflated tranche shares [1]. The attacker subsequently redeemed those artificial shares against the vault's reserves to siphon the deposited stablecoins [1]. Blockaid, which previously highlighted that illicit actors hold significant funds beyond administrative freeze capabilities (as detailed in an analysis of [unfreezable stolen crypto](https://basisdesk.news/news/blockaid-unfreezable-stolen-crypto-report)), framed the estimated $1.01 million loss as a running figure and warned that the incident remained active [1].

## Unclear Operator and Protocol Status

Blockaid linked the impacted contract to digital asset firms Valinor Digital and Fence, tagging both entities on social platform X [1]. However, the security firm did not confirm which organization directly operates the vault infrastructure, and neither firm issued an immediate public comment regarding the exploit [1].

It remains undetermined whether administrators have paused the underlying smart contracts, whether any lost funds remain recoverable, or how many depositors suffered direct losses [1]. The incident adds to historical flash-loan vulnerabilities on the Avalanche blockchain, including the February 2023 exploit of stablecoin platform Platypus, which lost $8.5 million to solvency-check manipulation [1].

## Sources

1. [Flash-Loan Attacker Drains About $1 Million in USDC From Avalanche-Based Tranche Vault](https://unchainedcrypto.com/flash-loan-attacker-drains-about-1-million-in-usdc-from-avalanche-based-tranche-vault/) — unchainedcrypto.com, 2026-10-28

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai