Tranche Vault on Avalanche Drained of $1.01m

An attacker has emptied a lending vault on the Avalanche blockchain of about $1.01m in USDC by using borrowed money to create shares out of thin air and then cashing them in. Security firm Blockaid flagged the attack in the early hours of 28 October, and the vault’s own on-chain record now shows a USDC balance of zero.

According to Blockaid’s alert on X, the target was a “Tranche Vault” linked to Fence Finance and Valinor Digital. “An attacker used a flash loan to mint inflated tranche shares, then redeemed the vault’s remaining USDC,” it wrote, putting the losses at “~$1.01M” across about two transactions and describing the exploit as ongoing.

What the on-chain record shows

Blockaid’s follow-up post lists the attacker’s addresses, the vault and an example transaction. TSN checked them against Avalanche’s public ledger. The cash-out transaction, at 00:00 GMT on 28 October, moved 1,013,353.61 USDC from the vault to a contract controlled by the attacker, which passed the same amount straight on to the attacker’s wallet.

About three and a half minutes earlier, at 23:56 GMT on 27 October, an earlier transaction sent exactly the same amount into the vault and back out again. That fits Blockaid’s count of about two transactions. A balance check on the vault’s address on the morning of 28 October returned no USDC at all.

In a flash loan, someone borrows a large sum and repays it within the same transaction, so they need no money of their own. Blockaid’s description suggests the vault let that temporary capital mint far more shares than it should have, and then paid out real USDC against them.

Whose pool it was

Avalanche’s Builder Hub explorer tracks the vault as part of a real-world asset (RWA) lending pilot called “Valinor × OatFi × Fence”. It describes it as an “SPV capital flow dashboard”, with lenders putting USDC into a tranche pool that finances a borrower. A banner now added to the page reads: “On October 27, 2026, an exploit drained funds from the tranche pool”. It warns users against putting more money into the pool and says “the facility administrator is investigating”.

Fence describes itself on its website as a “real-time facility agency for asset-backed finance”. Valinor calls itself “the modern credit institution”, and OatFi offers credit for business-to-business payments. As of the morning of 28 October, neither Fence nor Valinor had posted about the attack on X. None of the three firms has said who bore the loss, how the flaw got through, or whether any funds can be recovered.

Why tokenised credit pools are a new target

This attack did not break Avalanche itself. Nothing in Blockaid’s alert or the ledger points to a fault in the network. The losses come from the logic of one vault contract, and Blockaid’s account points to the way it priced new shares. Similar share-inflation bugs have long troubled DeFi vaults. What is newer is that the money at risk here was lender capital for a real-world credit facility, not just crypto trading funds.

That matters because tokenised credit is growing fast. When rwa.xyz took its mid-October snapshot, distributed real-world assets on public chains were worth $39.18bn. Pilots such as this one offer lenders same-day visibility into where their money goes. But they also expose that money to the same smart-contract risks as any DeFi protocol. A lender reviewing the deal might focus on the borrower’s credit quality, while the weakest point turns out to be the vault’s share maths.

The pattern of recent incidents points the same way. Hacken’s quarterly review found that most of the $1.18bn lost to crypto hacks in Q3 came through suppliers and infrastructure rather than core protocols. In recent weeks, Bloom’s users lost SOL from their wallets, Swell paused two liquid-staking tokens after a suspected key compromise and Zilliqa kept its X-Bridge shut after security incidents. Each time, the damage came from one specific component rather than the underlying chain.

What lenders should watch for

The Builder Hub page now shows only historical data for the pool. Lenders will need a statement from the facility administrator, or from Fence or Valinor, to learn whether the vault has been paused, whether the shortfall falls on them, and whether the code has been reviewed. Until then, the clearest facts are the ones on the ledger: $1.01m left in two transactions, and the vault has nothing left to pay out.