Security firms SlowMist and CertiK Alert reported on 28 October 2026 that a TranchePool vault on Avalanche lost about 1.01M USDC in an exploit. SlowMist first reported the loss at 03:14:55 UTC, and CertiK Alert followed at 03:48:47 UTC. Both are named as sources for the confirmed account of the incident. SlowMist said the loss was about 1.013M USDC from a TranchePool reportedly associated with ValinorDigital, Oatfi and Fence Finance. [1] [3]

The incident is labelled confirmed, backed by a primary source, on-chain data or several independent outlets. The two security firms give consistent accounts of the mechanism. SlowMist said the settlement logic treated a scheduled principal payment as received and subtracted it from the tranche's recorded outstanding principal, despite no USDC repayment. CertiK Alert said a scheduled accounting update reopened used draw capacity, enabling a second withdrawal against the same funding. [2] [4]

On the figures, SlowMist reported a loss of about 1.013M USDC. CertiK Alert reported that the Avalanche vault lost about $1.01M USDC in the exploit. SlowMist said the settlement logic restored 1.013M USDC of draw capacity, which it linked to the loss. The claims do not state any further figures, such as the value of any separate transactions. [1] [2] [3]

A separate, unverified account was reported earlier by The Defiant at 01:11:39 UTC. According to that report, Blockaid said a flash loan let the attacker mint inflated tranche shares and redeem the vault's USDC. The same report said a balance check showed none left in the identified contract. This account is labelled unverified, meaning it was reported by an established outlet but not confirmed at the source. [5] [6]

What remains unconfirmed is the earlier account attributed to Blockaid through The Defiant, including the flash-loan mechanism and the balance check finding no USDC in the identified contract. That version is not confirmed at the source and differs in its described mechanism from the settlement-logic explanation given by SlowMist and CertiK Alert. The claims do not state how the two accounts relate, and no further confirmation of the Blockaid report is given in the material. [2] [4] [5] [6]