TranchePool exploit on Avalanche drains $1.01M at midnight rollover

Three seconds after midnight UTC on 28 October 2026, an attacker drained 1,013,353.61 USDC from a TranchePool on Avalanche C-Chain linked to Valinor Digital, Oatfi and Fence Finance. The flaw was credit accounting: at the UTC day rollover the pool booked a scheduled principal repayment as paid without receiving any USDC, reopening draw capacity.

• 1,013,353.61 USDC stolen — the pool's entire USDC balance
• Attack executed at 00:00:03 UTC on 28 October 2026
• Funds bridged to Solana via CCTP in two transactions
• No oracle manipulation or reentrancy involved