Attacker drains $1.01 million in USDC from Avalanche Tranche Vault using flash loan

A security breach on the Avalanche blockchain led to the loss of approximately $1.01 million in USDC from a Tranche Vault late Tuesday, according to an alert from security firm Blockaid. The attacker reportedly exploited the system by initiating a flash loan, which enabled manipulation of the vault’s share count and allowed a substantial withdrawal of funds.

Ongoing exploit impacts Tranche Vault

Blockaid, a blockchain security company specializing in incident monitoring, reported the incident as ongoing, indicating that the situation was not yet resolved at the time of its statement. The vault in question is associated with Valinor Digital and Fence, two entities active in the decentralized finance (DeFi) space, though the precise operator of the vault remains unclear.

Neither Valinor Digital nor Fence had published any comments or statements regarding the breach when Blockaid’s alert became public. The alert was shared at 9:07 p.m. ET and warned that the exploit was still unfolding, suggesting the possibility of further losses.

Blockaid identified the exploit as “ongoing” and stated that the vault was “related to” Valinor Digital and Fence, but withheld confirmation regarding which party was responsible for its management.

At this stage, it remains uncertain whether the vault has been paused, if any funds are likely to be recovered, or how many depositors may have been affected by the attack.

Flash loans enable rapid attack

Flash loans, which are uncollateralized loans executed within a single transaction on the blockchain, have increasingly been used to exploit vulnerabilities in DeFi protocols. In this incident, the attacker reportedly used a flash loan to mint inflated shares of the vault, subsequently redeeming these shares for the USDC held in the vault.

Blockaid estimated the total funds drained at about $1.01 million, executed over two transactions. This figure was described as a running total by the firm, which warned the full impact could rise as the incident unfolded.

Mini dictionary: Flash loan — An uncollateralized loan that borrowers must take out and repay in a single blockchain transaction. Flash loans are often used in DeFi for arbitrage or, on occasion, to exploit protocol flaws, as they allow rapid, large-scale movements of funds with minimal risk to the attacker.

Previous incidents on Avalanche

DeFi protocols on the Avalanche network have experienced similar attacks involving flash loans. In February 2023, the decentralized stablecoin swap platform Platypus suffered a loss of around $8.5 million after a vulnerability in its solvency check mechanism was exploited with the aid of a flash loan.

Both the Valinor Digital- and Fence-linked vault and the Platypus attack underscore the vulnerabilities that flash loans can expose within complex DeFi systems.

As of now, further details about the ongoing exploit, potential fund recovery, and actions by Valinor Digital or Fence have yet to emerge, and the risk of additional losses remains.