Avalanche TranchePool drained of about $1.01M USDC in settlement-logic exploit

A TranchePool smart contract on Avalanche C-Chain lost about 1,013,000 USDC on 28 October 2026, according to blockchain security firm SlowMist. SlowMist lists the pool as associated with Valinor Digital, Oatfi and Fence Finance; Blockfence notes that the exact responsibilities of each party have not been established.

What reportedly happened

• SlowMist describes the cause as a settlement logic flaw: at the UTC day rollover, a scheduled principal payment was treated as received even though no USDC arrived. That reopened roughly $1.013M of draw capacity, which the attacker reportedly drew a second time (SlowMist).
• According to an on-chain write-up by Panda Security published on DEV Community, there was a setup transaction funded by an Aave v3 flash loan at 23:56:41 UTC on 27 October, followed by the drain of 1,013,353.61 USDC three seconds after midnight UTC.
• That report also says that the funds were then moved to Solana through Circle’s CCTP bridge in two transfers of about 250,000 and 763,375 USDC.
• Blockaid first flagged the incident and initially described it as inflated tranche-share minting; later analysis by SlowMist pointed to the settlement logic instead (The Defiant, Blockfence).

Avalanche itself and the USDC stablecoin were not compromised; the weakness was inside this one pool’s contract (Blockfence).

What is still unknown

As of 28 October, no confirmed recovery of the funds and no full assessment of depositor losses had been published (Blockfence). We will update this page if the teams involved publish a post-mortem.

What it means for crypto users and players

For casino transfers, our USDC payment and network guide separates acceptance of the token from support for a particular network. Neither establishes the safety of a contract holding it.

This was a DeFi lending pool, not a casino. The general lesson still applies to anyone who keeps stablecoins on a platform: any contract or service that holds your funds is a risk. Keep only what you need on any single platform, withdraw to a wallet you control, and check a platform’s licence and track record first. Our crypto casino safety checklist walks through those checks.

---

18+ only. Gambling involves risk of loss; only play with money you can afford to lose, follow the laws where you live, and use deposit limits or self-exclusion if play stops being fun. For help, contact a local support service such as BeGambleAware or Jugadores Anónimos.