An attacker drained approximately $1.013 million in USDC from a tranche vault on Avalanche on October 28, 2026, exploiting a smart contract accounting flaw before moving the stolen funds to Solana.
Blockchain security firm Blockaid identified the affected vault as associated with Fence Finance and Valinor Digital. The attacker used an Aave V3 flash loan involving 1,013,353.61 USDC to manipulate the vault’s withdrawal mechanisms, ultimately extracting funds held in the contract.
Subsequent research by SlowMist pointed to a settlement-logic vulnerability triggered at the UTC day rollover. According to that analysis, the contract incorrectly treated a scheduled principal payment as received, restoring borrowing capacity that had already been used.
The incident highlights a potentially serious weakness in decentralized lending infrastructure: smart contracts can execute transactions exactly as programmed while allowing users to withdraw more assets than their economic entitlements justify.
How the Attacker Exploited the Avalanche Vault
The attack unfolded across two transactions shortly before and after midnight UTC on October 27 and 28.
Transaction analysis indicates that the attacker borrowed 1,013,353.61 USDC through Aave V3 at approximately 23:56 UTC on October 27. The borrowed funds were deposited into the vault and subsequently withdrawn, allowing the flash loan to be repaid within the same transaction. The operation incurred approximately 506.68 USDC in borrowing fees.
Shortly after midnight, a second transaction extracted another 1,013,353.61 USDC from the vault without an equivalent new deposit.
The affected contract was identified as 0xE25CB545Bdd47a8Ec2d08001cb5661B00D47621a. The attacker used the contract address 0xF09DCf4EdE2a88bd316ff355dFC333A281a57805, with proceeds forwarded to a separate wallet.
Blockaid initially described the attack as a flash-loan-assisted manipulation of tranche shares. Under its explanation, the attacker created inflated claims against underlying reserves and then redeemed those claims to withdraw USDC belonging to the vault.
A tranche-based lending structure typically allocates capital across different risk categories, with investors receiving claims on their respective portions of the underlying assets. The contract must preserve those economic entitlements when deposits, repayments and withdrawals occur.
When that accounting relationship breaks down, an attacker can potentially extract value from the wider pool without supplying an equivalent amount of capital.
SlowMist Identifies a Settlement Flaw at Midnight
SlowMist’s subsequent investigation provided a more specific explanation centered on how the vault recorded outstanding principal and settled repayments.
According to the security firm’s analysis, a scheduled principal payment was incorrectly recognized during the UTC day rollover. That accounting update restored approximately $1.013 million in available draw capacity despite the corresponding funds not having been repaid.
The attacker could consequently withdraw the same amount a second time, effectively extracting existing reserves using borrowing capacity that should no longer have been available.
The distinction between the two investigations matters. Blockaid emphasized inflated tranche-share claims, while SlowMist identified an incorrect settlement transition. These descriptions may reflect different aspects of the exploit, but they should not be treated as identical technical findings without a complete contract-level reconstruction.
The underlying problem resembles the share-accounting vulnerability affecting UNCX Network earlier in October, although the affected contracts and exploitation methods differ.
An official postmortem establishing the precise vulnerable code path, the scope of other exposed contracts and the responsibility of individual developers or operators remains necessary.
Stolen USDC Moves to Solana as Recovery Questions Grow
The attacker moved the proceeds away from Avalanche almost immediately after the second withdrawal.
Cross-chain transaction tracing published after the incident indicates that approximately 1.013 million USDC was transferred through Circle’s Cross-Chain Transfer Protocol, known as CCTP, to Solana.
CCTP uses a burn-and-mint mechanism to transfer native USDC between supported blockchains without requiring a conventional pool of wrapped tokens.
The Solana transaction trail reportedly shows the transferred funds being exchanged for approximately 5,007 SOL and 506,656 USDe, the synthetic dollar issued by Ethena. Those amounts represent preliminary traced holdings rather than a confirmed final recovery balance.
Moving the proceeds across blockchains complicates recovery because investigators must track subsequent swaps, wallet transfers and interactions with other protocols. The bridge’s involvement does not establish that Circle’s infrastructure was compromised.
The incident follows other October security failures involving cross-chain asset movements, including Initia’s approximately $2.7 million exploit, which led to an emergency blockchain halt.
A separate October 28 report also described an on-chain message from an address associated with Fence Finance offering the attacker a 10% bounty in exchange for returning 90% of the stolen assets. The authority behind that message and any response from the attacker have not been independently established.
The contractual roles of Fence Finance, Valinor Digital and OatFi in the affected vault remain important unresolved questions. Avalanche’s developer documentation identifies a Valinor, OatFi and Fence capital-flow pilot, but that association alone does not establish which party controlled the vulnerable contract or bears responsibility for depositor losses.
Why the Exploit Matters for DeFi Investors
The immediate financial loss is relatively modest compared with the largest cryptocurrency thefts. Nevertheless, the underlying vulnerability raises uncomfortable questions about how decentralized lending platforms account for capital.
Investors frequently judge lending protocols by the quality of their collateral, published yields, utilization rates and security audits. Those indicators matter, but they cannot compensate for a contract that incorrectly determines whether money has already been borrowed or repaid.
In this case, the apparent failure occurred in the system responsible for recognizing settlement events. A scheduled repayment appears to have been treated as an actual economic repayment, giving the attacker access to funds that should have remained unavailable.
That distinction is fundamental. A lending platform cannot safely calculate available capital unless it reliably separates expected cash flows from money actually received.
The timing is particularly revealing. A state transition at midnight should not create new economic value or restore previously exhausted withdrawal rights. If a routine change of date can produce that outcome, it suggests that critical accounting assumptions were not consistently enforced.
Similar weaknesses can remain unnoticed during ordinary operations because legitimate users rarely construct transactions specifically designed to exploit unusual settlement conditions.
That makes adversarial testing essential. Security reviews need to examine not only individual contract functions but also the economic consequences of executing them in unexpected sequences, particularly around repayment schedules, maturity dates and changes in accounting periods.
Another important issue is the distinction between stablecoin safety and protocol safety. The stolen asset was USDC, but there is no indication that the stablecoin itself malfunctioned. The loss arose from the application controlling how USDC could be withdrawn.
For investors, that means holding a dollar-denominated token inside a lending vault introduces risks beyond those associated with holding the token directly.
The cross-chain movement also illustrates how quickly recovery opportunities can narrow. Converting stolen USDC into SOL and USDe changes the practical options available to investigators and asset issuers. Whether those balances can be identified, restricted or recovered depends on the assets, their controls and subsequent transactions.
Earlier incidents involving cross-chain treasury security have similarly demonstrated why the location of stolen assets and the original point of compromise must be evaluated separately.
The Avalanche incident also reinforces a lesson from the BitBay StableVault withdrawal exploit: an ordinary-looking vault can become vulnerable when its internal accounting enters an exceptional state.
The next meaningful developments will be an authoritative technical postmortem, confirmation that the vulnerable settlement logic has been disabled or corrected, and a clear accounting of any affected depositors.
Investors should also watch for a verified recovery agreement, asset returns and disclosures identifying who operated or controlled the vault. A proposed bounty alone does not amount to reimbursement.
Ultimately, the biggest concern is not simply that $1.013 million disappeared. It is that a legitimate settlement mechanism may have allowed the same capital to be withdrawn twice. Until the precise failure is documented and corrected, questions about the security of similar lending arrangements will remain.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574