An attacker pulled roughly $1.01 million in USDC out of a Tranche Vault on Avalanche on the evening of Tuesday, Oct. 27, ET, by using a flash loan to inflate the vault’s share count before cashing out, security firm Blockaid said in an alert on X.

Blockaid called the exploit “ongoing” and said the vault was “related to” Valinor Digital and Fence, tagging both companies’ X accounts. The alert did not say which entity operates the vault, and neither company had commented publicly on the incident at the time of writing.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

How the Attack Worked

A flash loan is a large, uncollateralized loan that must be borrowed and repaid inside a single blockchain transaction. According to Blockaid, the attacker used one to “mint inflated tranche shares,” then used those shares to claim the USDC the vault still held. The firm put the loss at about $1.01 million “so far,” spread across roughly two transactions, and posted its alert at 9:07 p.m. ET.

It was not clear whether the vault had been paused, whether any of the funds could be recovered, or how many depositors were affected.

Earlier Avalanche Flash-Loan Exploits

Flash loans have been used against Avalanche DeFi protocols before. In February 2023, the stablecoin swap platform Platypus lost about $8.5 million after an attacker combined a flash loan with a flaw in the protocol’s solvency check.

Blockaid’s figure for the Tranche Vault was framed as a running total, and the firm described the attack as still in progress when it posted.

Related Listen: Why Smart Contract Risk Isn’t the Real Threat to Vaults Anymore