On October 27, 2026, an attacker targeted a Tranche Vault on the Avalanche blockchain linked to Fence Finance and Valinor Digital, using a flash loan to manipulate the vault’s share accounting. The initial transaction occurred at 23:56:41 UTC, when the attacker borrowed 1,013,353.61 USDC, deposited it into the vault, and withdrew it within the same transaction.
On October 28, at 00:00:03 UTC, the attacker exploited the settlement flaw to withdraw the same amount again, draining approximately $1.01 million in USDC from the vault. Security analytics firm Blockaid reported the exploit and identified the affected vault.
🚨Blockaid detected an ongoing exploit on Tranche Vault related to @fence_finance and @valinordigital on Avalanche. An attacker used a flash loan to mint inflated tranche shares, then redeemed the vault’s remaining USDC.
~$1.01M drained from the vault so far across ~2 txs. 🧵— Blockaid (@blockaid_) October 28, 2026
The attack exploited a flaw in the vault’s tiered liquidity system. The attacker used a flash loan to borrow a large amount of capital and mint more tranche shares than they should have received. They then inflated the value of those shares, immediately redeemed them to withdraw the vault’s remaining USDC, and repaid the original loan.
How a double-settlement flaw drained the vault
X user ItsSunshine described the exploit as a double-settlement vulnerability. According to Sunshine, the attacker deposited funds borrowed through a flash loan and claimed them within the same transaction before the order expired. This first action cost the attacker a relatively small fee of approximately 506 USDC.
🚨Blockaid detected an ongoing exploit on Tranche Vault related to @fence_finance and @valinordigital on Avalanche. An attacker used a flash loan to mint inflated tranche shares, then redeemed the vault’s remaining USDC.
~$1.01M drained from the vault so far across ~2 txs. 🧵— Blockaid (@blockaid_) October 28, 2026
Just 163 blocks later, the attacker claimed the funds a second time after the expiry period had passed. This sequence suggests that the vault failed to update its internal records correctly between related transactions, allowing the same funds to support multiple claims.
The vulnerability arose because the vault did not properly separate deposit timestamps from withdrawal functions. As a result, temporarily borrowed funds could be treated as legitimate assets that the attacker was entitled to withdraw.
Another user, Renji, noted that this type of attack has become a familiar pattern in decentralized finance (DeFi).
@blockaid_ @fence_finance @ValinorDigital flash loan mints inflated shares then redeems the vault’s usdc. that’s the whole pattern, ~1m in two txs. classic
— Renji Does DYOR (@renjidoesdyor) October 28, 2026
Read also: Avalanche Advances Multi-Layer Blockchain Architecture Amid Rising Demand
Avalanche exploit highlights risks in smart contract security
The incident raises questions about how DeFi platforms present the security of their systems to users. The industry often encourages users to protect their funds by securing their hardware wallets and avoiding phishing links. However, these precautions cannot prevent losses caused by flaws in a protocol’s smart contracts.
A crypto veteran known as Emlanis expressed frustration that the attacker did not need to compromise a wallet, steal private keys, or trick anyone into approving a malicious transaction. Instead, the weakness was entirely within the vault’s internal logic.
Emlanis argued that decentralization removes the need to rely on traditional banks but creates another form of risk where users must trust that developers have written smart contracts with accurate and reliable accounting rules. When those rules fail, users can lose their funds even if they have protected their passwords and private keys.
another day, another $1M gone from DeFi.
this time, a Tranche Vault linked to Fence Finance and Valinor Digital on Avalanche
according to Blockaid, an attacker exploited the vault using a flash loan, manipulated its share accounting, and walked away with roughly $1.01M in USDC.
and here’s what bothers me.
the attacker reportedly didn’t need to steal anyone’s private keys, compromise a wallet, or trick users into signing malicious transactions.
the weakness was in the vault’s own logic.
think about that.
you deposit your assets into a smart contract believing the rules governing withdrawals are mathematically sound.
then someone discovers those rules can be manipulated to withdraw funds they shouldn’t be entitled to.
your wallet could be perfectly secure, yet your money is still gone.
as someone who has spent years around DeFi, i find these incidents particularly troubling.
we talk so much about decentralization, transparency, and removing trust from financial systems.
but how much protection do these promises offer when the accounting inside a smart contract fails?
flash loans aren’t inherently the problem. they’re just tools.
the real concern is a system that reportedly allowed temporary liquidity to be turned into an illegitimate claim on real assets.
and once again, it’s the people who trusted the protocol who may end up paying the price.
the reported loss is around $1.01 M. the full impact on depositors and any recovery plans remain unclear.
DeFi doesn’t just need more liquidity.
it needs accounting logic that attackers can’t turn against the people it’s supposed to protect.
— emlanis ⚡️ (@emlanis_) October 28, 2026
This places much of the security risk on depositors, who may have little control over how a protocol’s smart contracts operate. Flash loans are not inherently malicious. They allow users to borrow large amounts of capital without collateral, provided the loan is repaid within the same transaction. However, they can also expose weaknesses in poorly designed accounting systems by allowing attackers to execute complex financial operations almost instantly.
The Avalanche incident demonstrates how a flaw in a vault’s accounting logic can turn a legitimate DeFi mechanism into a tool for draining user funds. Until protocols can ensure that their smart contracts handle deposits, share issuance, and withdrawals correctly, the promise of a secure, trustless financial system will remain difficult to achieve.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics
