An attacker used a flash loan to inflate tranche shares and withdraw about $1.01 million in USDC from an Avalanche vault, Blockaid said.
A flash-loan exploit drained about $1.01 million in USDC from an Avalanche-based Tranche Vault on Tuesday, Oct. 27, according to security firm Blockaid. The attacker borrowed funds, inflated the vault’s share count and used those shares to withdraw its remaining USDC, the firm reported in an alert on X. The amount was a running estimate, not a confirmed final tally: Blockaid said the incident was still underway when it published the alert.
Blockaid described the incident as “ongoing” when it posted at 9:07 p.m. ET. It said the vault was “related to” Valinor Digital and Fence, and tagged both companies. The alert didn’t identify the vault’s operator, and neither company had publicly commented at the time of writing. That leaves basic questions about who controlled the vault and what response was possible unanswered.
The limited information matters. A security alert can identify suspicious activity and estimate losses quickly, but it doesn’t necessarily establish how a protocol’s contracts were configured, which users were exposed or whether funds remain recoverable. Those details require confirmation from the people operating the vault and, potentially, further analysis of the transactions.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
How the exploit worked
Flash loans are uncollateralized loans that must be borrowed and repaid within one blockchain transaction. That short window is central to their design: the borrower can temporarily access a large pool of assets, but the transaction must satisfy the loan’s repayment conditions before it completes. If it doesn’t, the transaction generally fails rather than leaving an ordinary unpaid loan behind.
Blockaid said the attacker used one to “mint inflated tranche shares,” then exchanged those shares for USDC held by the vault. In broad terms, vault shares represent a user’s claim on assets held in a pool. If a contract mistakenly issues more shares than the deposited assets justify, those shares can distort the accounting used to determine how much a holder may withdraw. The alert doesn’t explain the contract-level flaw, so the precise path from the flash loan to the inflated share count remains unconfirmed.
The firm estimated the loss at about $1.01 million “so far,” across roughly two transactions. That estimate suggests the activity was concentrated, but it doesn’t establish whether the transactions captured the full impact. The wording leaves open the possibility that Blockaid was still tracking related activity or refining its estimate when it posted.
At the time of Blockaid’s alert, it was unknown whether the vault had been paused, whether the funds could be recovered or how many depositors were affected. Those aren’t minor details. A pause could limit further withdrawals if the vault’s design and operators allow it, while recovery would depend on where the assets went and what control the protocol retained. The alert didn’t answer either question.
Why share accounting matters
A vault is more than a container holding tokens. Its contracts must keep track of deposits, withdrawals and each participant’s share of the pooled assets. In systems that issue shares, those numbers are the accounting layer through which users’ claims are represented. An error in that layer can create a route to assets even when the attacker hasn’t simply broken into a wallet or stolen a private key.
That distinction is useful when interpreting the incident, but it shouldn’t be mistaken for a full technical diagnosis. Blockaid’s description points to share inflation and a withdrawal of USDC; it doesn’t identify which validation failed or whether other conditions contributed. Here’s the thing: without the contract details and a complete account of the transactions, readers can understand the reported sequence, but not yet independently assess the underlying bug.
For users, the practical question is exposure. A vault’s reported connection to a company doesn’t by itself show who deposited into it, how losses might be allocated or whether the company operated the contracts. Those facts need confirmation. Until then, the headline loss gives a sense of scale, while the individual impact remains unclear.
A history of flash-loan attacks on Avalanche
The incident follows earlier flash-loan exploits involving Avalanche DeFi protocols. In February 2023, stablecoin swap platform Platypus lost about $8.5 million when an attacker paired a flash loan with a flaw in the protocol’s solvency check. That earlier case involved a different protocol and a different reported weakness, so it doesn’t establish that the Tranche Vault incident had the same cause.
The connection is the broader pattern: flash loans can give an attacker temporary access to capital that helps exploit a weakness elsewhere in a contract system. The loan itself isn’t necessarily the vulnerability. Rather, it can make an attack more powerful by allowing the attacker to create a large position within one transaction, then use a faulty check or accounting rule to extract value.
This is more significant than it looks. Treating flash loans as the whole explanation can obscure the design or implementation issue that made the withdrawal possible. For teams building on-chain financial products, the reported sequence is a reminder that share issuance and redemption rules need to hold under unusual transaction conditions, including when a user can temporarily control a large amount of capital. (And this is the part most people overlook.) A transaction can be atomic and still expose a flaw in the assumptions a contract makes during that transaction.
What remains unresolved
Blockaid presented the Tranche Vault loss as a running total and said the attack was still underway when it published its alert. That leaves the final amount lost and the impact on depositors unresolved. The alert also doesn’t establish whether the vault was paused, whether any funds were returned or how the companies it tagged related to the vault’s operation.
If you're working in this space, the next useful update will be one that answers those operational questions and explains the contract behavior behind the inflated shares. A clear account would help users distinguish confirmed losses from early estimates and understand whether the issue was contained. Until then, the reported amount is a snapshot of an evolving incident. Not the final accounting.
Related Listen: Why Smart Contract Risk Isn’t the Real Threat to Vaults Anymore
The post Flash-Loan Attacker Drains About $1 Million in USDC From Avalanche-Based Tranche Vault appeared first on Unchained.
Discussion
Sign in to join the discussion.