TranchePool exploit on Avalanche (27-28 Oct 2026): about 1.013M USDC drawn a second time at the UTC day rollover, per SlowMist

• Scam type: Hack
• Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
• Project or site name: TranchePool on Avalanche (SlowMist: reportedly associated with Valinor, Oatfi and Fence)
• Incident date: 2026-10-28
• Reported: 2026-10-28
• Last updated: 2026-10-28

An attacker drew 1,013,353.61 USDC a second time from a TranchePool lending contract on Avalanche C-Chain. SlowMist reported the pool as associated with Valinor, Oatfi and Fence. This report lists the attacker wallet named by SlowMist. What happened: SlowMist said that at the UTC day rollover the pool's settlement logic treated a scheduled principal payment as received without any USDC repayment, which restored about 1.013M USDC of draw capacity. CertiK described it as a scheduled accounting update that reopened used draw capacity, allowing a second withdrawal against the same funding.…