Fence Finance tranche pool, Avalanche hack — October 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | October 28, 2026 |
| Target type | Lending protocol |
| Loss | $1,013,354Price at time of incident |
| Method | Contract logic errorThe borrower draw check subtracted principal borrowed and not yet due but ignored principal that had fallen due unpaid, so a scheduled repayment that was never made restored the full borrowing limit at the UTC day rollover |
| Chains | Avalanche |
| Outcome | Unresolved |
What happened
Fence is an asset-backed lending platform. Its Avalanche USDC pool, associated by SlowMist with Valinor Digital and Oatfi, runs several lending tranches inside one contract, in which lenders deposit and a borrower draws. According to Defimon, anyone could open a tranche and name themselves its admin and borrower. At 23:56 UTC on 27 October 2026 an attacker’s contract flash-borrowed 1,013,353.61 USDC from Aave, opened a tranche with itself in every role, deposited the loan as lender, scheduled a principal repayment of the same amount due at midnight, drew the deposit straight back out as borrower and repaid Aave.
At 00:00:03 UTC on 28 October the attacker drew again. Once the day had rolled over, the pool booked the scheduled repayment as if it had been paid, and its draw check, which ignores principal that has fallen due unpaid, restored the full borrowing limit. Because every tranche is paid from one shared balance, the pool paid out 1,013,353.61 USDC that belonged to another tranche’s lenders. This registry read the second transaction’s receipt and confirmed that amount moving from the pool to the attacker. Phalcon and CertiK published the same root cause.
Fence offered the attacker a 10% bounty in on-chain messages on 28 October, asking for 90% of the funds back and saying the money had been traced. Nothing had been returned by the time of recording.
Sources
- Avalanche drain transaction, read by this registryOn-chain · retrieved 2026-10-28
- Defimon analysis on X (28 October 2026)Secondary · retrieved 2026-10-28
- BlockSec Phalcon analysis on X (28 October 2026)Secondary · retrieved 2026-10-28
- CertiK alert on X (28 October 2026)Secondary · retrieved 2026-10-28
- Fence’s on-chain bounty offer, reposted by Defimon (28 October 2026)Secondary · retrieved 2026-10-28
Changes to this entry
- Recorded the day of the drain from our read of the transaction and three independent analyses. The setup transaction ran on 27 October; the loss landed at 00:00:03 UTC on 28 October.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Fence Finance tranche pool, Avalanche hack — October 2026", iTokenly, accessed 2026-10-28, https://itokenly.com/hacks/fence-tranche-pool-avalanche-october-2026https://itokenly.com/hacks/fence-tranche-pool-avalanche-october-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.