BTC 
ETH 
BNB 
XRP 
SOL 
TRX Avalanche vault loses ~$1.01M USDC in draw-capacity exploit
SlowMist and CertiK Alert report that roughly 1.01M USDC was lost from a TranchePool vault on Avalanche. SlowMist attributes the loss to settlement logic that treated a scheduled principal payment as received at the UTC day rollover, restoring draw capacity so the attacker could draw the same amount again with identical calldata. CertiK describes the cause as a scheduled accounting update that reopened used draw capacity, enabling a second withdrawal against the same funding.
Why “Confirmed”
- Reported by a security researcher (SlowMist, CertiK Alert) and one more independent source
2 independent source groups across 2 posts · evidence score 91/100. How labels work
Other reports on this event
Its sources described the event in different words, so it was kept as a separate story with its own label. How reports are linked
What the sources claim
-
SlowMist reports a loss of about 1.013M USDC from a TranchePool reportedly associated with ValinorDigital, Oatfi and Fence Finance.
“Loss: ~1.013M USDC from a TranchePool reportedly associated with @ValinorDigital, Oatfi, and @fence_finance”
SlowMist -
SlowMist says the settlement logic treated a scheduled principal payment as received at the UTC day rollover despite no USDC repayment, restoring 1.013M USDC of draw capacity.
“treated a scheduled principal payment as received and subtracted it from the tranche’s recorded outstanding principal, despite no USDC repayment”
SlowMist -
CertiK Alert reports that an Avalanche vault lost about $1.01M USDC in an exploit.
“An Avalanche vault lost ~$1.01M USDC in exploit.”
CertiK Alert -
CertiK says a scheduled accounting update reopened used draw capacity, enabling a second withdrawal against the same funding.
“A scheduled accounting update reopened used draw capacity, enabling a second withdrawal against the same funding.”
CertiK Alert
Sources
- 🚨 SlowMist TI Alert 🚨 → slowmist.ai
- #CertiKAlert 🚨 → snowtrace.io
More in Hacks & Security
Summary and claims extracted by AI with prompt analyze-story@5 on 2026-10-29 00:00 UTC. Labels are computed from the sources, not by the model.