TranchePool Attack Transfers About 1.0134 Million USDC in 202 Seconds

GCSA said an attacker exploited a cross-day settlement flaw in Avalanche-based TranchePool to transfer about 1.0134 million USDC in 202 seconds. The flaw affected the vault application, not the underlying Avalanche network.

The findings describe the attacker using flash loans and repeated withdrawals.

A separate finding concerned a phishing campaign that impersonated the identity security@ku.com to pose as KuCoin. GCSA said the campaign tried to induce users to download remote-control software. The domains used lacked DMARC configuration. After GCSA notified KuCoin, the exchange completed remediation and enabled a DMARC quarantine policy.

GCSA also flagged a possible software supply-chain risk involving an MCP toolkit referenced in Bitkub's official documentation. After the original package was removed, a third party re-registered its npm package name. GCSA warned that installing the package without pinning its version, or using plaintext keys, could expose credentials. It found no evidence of actual theft and said Bitkub had not responded to its notification.

GCSA said it notified the relevant platforms and published its analyses and supporting evidence.