Avalanche TranchePool Hack Drains $1.01M USDC via Flaw

Settlement bug on Avalanche has wiped out $1.01 million USDC from an institutional private credit vault, revealing ongoing vulnerabilities in tokenized credit infrastructure. A TranchePool of Valinor Digital, Oatfi, and Fence Finance suffered a loss of around 1.013 million USDC around the UTC day rollover. Per SlowMist, the pool posted scheduled principal as received for a new UTC day without confirmation of actual on-chain repayment. This erroneous indication was used to reactivate draw capacity before an attacker repeatedly invoked draw function 0x8e27c105 with the same calldata to carry out a double draw. The breach was initially reported on X.