Flash-Loan Attacker Drains $1.01 Million in USDC From Avalanche Tranche Vault

Inflated Tranche Shares Drained the Vault

Roughly $1.01 million in USDC was pulled out of a Tranche Vault on the Avalanche (AVAX) network on the evening of Tuesday, October 27, ET, by an attacker who borrowed through a flash loan, minted an inflated batch of tranche shares and converted those shares into the deposits the vault still held. Security firm Blockaid pegged the loss at roughly $1.01 million so far and called the exploit ongoing when it published its alert on X at 9:07 p.m. ET. The theft was carried out across about two transactions, a footprint anyone can check directly on-chain. The firm was reading live activity rather than reconstructing a completed raid, and it presented its total as cumulative rather than final. A flash loan is uncollateralized borrowing that must be taken out and repaid within one blockchain transaction, so a caller can command momentary size while risking none of the principal. In this case the borrowed funds minted tranche shares at an inflated count, and those shares were then redeemed against the USDC the pool still held. Tranche vaults split deposits into layered positions with different risk and return profiles, so an inflated share count converts directly into a larger claim on the pool. That matters for sizing the damage: an inflated share count is only profitable if the pool still holds redeemable USDC, which is exactly what the attacker converted. Blockaid said the vault was “related to” Valinor Digital and Fence and tagged both companies' X accounts, but the alert stopped short of naming the operator. Neither company had commented publicly on the incident at the time of writing. As a stablecoin, USDC is built to track the dollar, and the USDC price was not the target here; the exposure sits entirely in deposited balances.

What was still unresolved when the alert went out matters as much as the loss itself. The firm left open whether a pause was in place, whether recovery of the stolen USDC was possible, and how many depositors were exposed. Its $1.01 million was explicitly a running total rather than a final count, which means the number can rise if the attack continued past 9:07 p.m. ET. Neither Valinor Digital nor Fence had issued a statement, a pause notice or a remediation plan at the time of writing, so depositors have no official account of whether withdrawals are functioning or what share of the pool they should expect back. The two-transaction footprint gives investigators a narrow window: once proceeds leave the vault contract, recovery depends on how quickly the operator reacts and whether frontends still hold pending withdrawals. Running totals also complicate compensation math, because each depositor's eventual loss share cannot be fixed until the count stops moving. The design of the attack places it in a pattern Avalanche (AVAX) has seen before. In February 2023, Platypus, a stablecoin swap platform on the same network, lost roughly $8.5 million when an attacker paired a flash loan with a broken solvency check. Tuesday's incident follows the same shape: borrowed capital, inflated share accounting, a claim on deposits, and repayment of the loan inside the same transaction, all completed before most depositors could act. No key theft has been alleged in the Tranche Vault case, which points review teams toward share-price logic and solvency assumptions, the same surface covered in Blockchain Security Audits. For holders weighing exposure to USDC vaults, the practical question is operational: whether the operator pauses, discloses and reprices shares before the running total grows.

Recovery, Pause and Operator Still Unnamed

The load-bearing facts here are the on-chain ones. The two transactions behind the drain can be traced on an explorer today, and the destination wallet address will show whether the proceeds are parked or already moving toward a mixer; that trace, not any press statement, will set the recovery odds. Three disclosures decide the rest: a pause confirmation, a named operator, and a final figure replacing the running total. The failure also sits at the vault layer, not in the issuer's rails: Circle's USDC Match pairs institutional mints and redemptions in hourly auctions, and that machinery was untouched. The closest recent parallel is the Initia exploit, which left USDC reserves at $63 with no restart date. Until one of these disclosures lands, the $1.01 million should be read as a floor, not a settlement.