Tranche Vault on Avalanche Drained of 1.01 Million USDC

Tranche vaults split deposits into risk layers, a structure borrowed from traditional securitization and increasingly used in DeFi credit products that package real-world or on-chain loans. The Avalanche vault tied to Valinor Digital, OatFi and Fence Finance followed this model, with Fence and OatFi supplying the underlying credit logic. Flash loans, which let an attacker borrow and repay enormous sums within one transaction, have been a known attack vector since the 2020 bZx exploits and remain a recurring tool against share-pricing mechanisms.

Depositors in the affected pool cannot withdraw their USDC, and the Avalanche Builder Hub has told users not to deposit into the identified contract while it investigates. Valinor Digital, OatFi and Fence Finance now face the task of tracing roughly $1.01 million in losses, reconciling two conflicting technical explanations, and rebuilding trust with liquidity providers before relaunching. Other protocols using similar tranche-settlement logic gain a concrete reason to audit how they timestamp scheduled payments.

Two accounts of the same breach being reported in parallel, one blaming inflated share minting via flash loan and another blaming a UTC day-rollover settlement flaw, is itself a warning sign about how little clarity even security firms have in the first hours after a DeFi hack. Composability that lets a flash loan interact with a credit pool's internal accounting was always the point of open DeFi, yet here it becomes the attack surface, exposing how fragile tranche logic remains once real money sits behind it.

Blockaid called the exploit 'ongoing' as of its alert tagging Valinor Digital and Fence on X, so the immediate marker to watch is whether either company publishes a formal postmortem confirming which of the two mechanisms, inflated shares or payment-timing, actually drained the funds. A follow-up from the Avalanche Builder Hub on whether the contract is patched, paused permanently, or relaunched will determine if depositors see any path to recovering the $1.01 million.

AvalancheAVAX it is the asset of the company or protocol in the event

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.