Avalanche Tranche Vault Loses About $1.01 Million in USD Coin (USDC)

A Tranche Vault on Avalanche has lost about $1.01 million in USD Coin (USDC) so far after an attacker used a flash loan to inflate shares and redeem the vault’s remaining funds, Blockaid said.

The attack took place Tuesday evening, Oct. 27, ET. Blockaid’s alert, posted at 9:07 p.m. ET, put the running loss at about $1.01 million across roughly two transactions and described the exploit as ongoing.

Blockaid said the attacker borrowed funds to mint inflated tranche shares, then redeemed those shares for USDC still held by the vault. A flash loan must be borrowed and repaid within the same blockchain transaction.

The security firm described the vault as related to Valinor Digital and Fence, tagging both in its alert. The alert did not identify the vault’s operator.