An attacker drained about $1.01 million in USD Coin (USDC) from an Avalanche tranche vault tied to Fence Finance and Valinor Digital after exploiting its share structure, Blockaid said.
Blockaid said its threat-intelligence team spotted the activity in real time. The vault lost its reserves in about two transactions, the firm said. The attacker used a flash loan to inflate the tranche-share balance, then redeemed those shares for the USDC left in the vault.
Blockaid’s 2026 Fund Recovery Threat Landscape report reviewed 60 major exploits and recorded no funds frozen or recovered through issuer blacklists. It said blacklist mechanisms were technically available in 16 incidents. USDC has a smart-contract blacklist function, but the report’s sample included no freeze or recovery through that route.
The report said stolen stablecoins generally reached decentralized exchanges after a median of 18 minutes, where they were often converted into assets that could not be frozen. Blockaid said that pace can outstrip manual efforts to contact issuers after an exploit.
