$1M Drained in Minutes: How a Flash Loan Just Emptied an Avalanche Vault
A Tranche Finance vault on Avalanche was completely emptied of 1.01 million USDC after an attacker weaponized a flash loan to print inflated shares and walk out with everything inside.
Blockaid, the onchain security firm that flagged the incident, confirmed the mechanics: the attacker borrowed funds, used them to artificially inflate the value of tranche shares within the vault, redeemed those shares for the real underlying USDC, and repaid the loan, all in a single transaction. When analysts checked the contract balance afterward, it read zero. Not close to zero. Zero.
How the Attack Worked
Flash loan exploits follow a familiar playbook, but they keep landing because protocols continue to rely on spot balances or manipulable internal accounting as price sources. In this case, the vault's share-minting logic did not adequately account for the possibility that an attacker could temporarily distort the ratio between deposited assets and minted shares.
The attacker exploited that gap in one atomic move:
1. Borrowed a large sum via flash loan 2. Injected funds to skew the vault's internal accounting 3. Minted tranche shares at an inflated rate 4. Redeemed those shares for real USDC from the vault 5. Repaid the flash loan, pocketing the difference
The entire sequence completed before any circuit breaker or guardian could intervene. That is the defining feature of flash loan attacks: by the time a block confirms, the damage is done.
Why This Keeps Happening
This is not a new class of attack. Flash loan exploits have drained hundreds of millions from DeFi protocols since 2020, hitting everything from lending markets to yield aggregators. The persistence of this vector points to a structural problem: protocols are still being deployed without robust price manipulation resistance, and audits are not catching edge cases at the accounting layer fast enough.
Avalanche's broader DeFi ecosystem has been growing, which means more capital is sitting in contracts that attackers are actively pressure-testing. A rising TVL environment is also a rising target environment.
What to Watch
If you hold funds in any vault-based or tranched yield product on Avalanche, now is the time to review the underlying contract architecture, not tomorrow. Check whether the protocol has published a post-mortem or paused operations. Silence from a team after a confirmed zero-balance drain is itself a signal.
More broadly, this exploit is a reminder that yield in DeFi carries smart contract risk that does not appear in the APY number. The higher the complexity of a product's share-minting logic, the wider the surface area for exactly this kind of attack.
Blockaid's ability to identify and label the exploit quickly is worth noting. Onchain security monitoring is becoming a genuine layer of DeFi infrastructure. Protocols that have not integrated it yet are flying without radar.