-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0283
============================================================

Advisory-ID:  0xCERT-2026-0283
Severity:     High
Published:    2026-10-27T00:00:00.000Z
Updated:      2026-10-29T07:23:32.452Z
Chains:       Avalanche
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0283

Title: Fence Finance Tranche Vault Share Inflation

Summary
- -------
A flash-loan attacker inflated vault share accounting to drain about 1.01 million USDC from an Avalanche Tranche Vault linked to Fence Finance and Valinor Digital.

Details
- -------
Summary
A flash-loan attacker inflated vault share accounting to drain about 1.01 million USDC from an Avalanche Tranche Vault linked to Fence Finance and Valinor Digital.

Incident
- - Victim: Fence Finance
- - Date (UTC): 2026-10-27
- - Estimated loss: $1.0M
- - Chain(s): Avalanche
- - Attack type: flash-loan exploit
- - Funds status: stolen

Recommended actions
- - Revoke token approvals granted to Fence Finance contracts until the project confirms they are safe
- - Integrators: pause or delist affected assets and monitor for attacker fund movements
- - Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only

Source & attribution
Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/fence-finance-2026. Primary sources: https://unchainedcrypto.com/flash-loan-attacker-drains-about-1-million-in-usdc-from-avalanche-based-tranche-vault/ ; https://www.cryptotimes.io/2026/10/28/avalanche-vault-hack-1-01m-usdc-drained-in-flash-loan-exploit-tied-to-valinor-and-fence/ ; https://en.coin-turk.com/attacker-drains-1-01-million-in-usdc-from-avalanche-tranche-vault-using-flash-loan/ ; https://www.kucoin.com/news/flash/hackers-steal-1-01m-from-tranche-vault-on-avalanche.

References
- ----------
- - https://www.blockchainbreaches.com/en/breaches/fence-finance-2026
- - https://unchainedcrypto.com/flash-loan-attacker-drains-about-1-million-in-usdc-from-avalanche-based-tranche-vault/
- - https://www.cryptotimes.io/2026/10/28/avalanche-vault-hack-1-01m-usdc-drained-in-flash-loan-exploit-tied-to-valinor-and-fence/
- - https://en.coin-turk.com/attacker-drains-1-01-million-in-usdc-from-avalanche-tranche-vault-using-flash-loan/
- - https://www.kucoin.com/news/flash/hackers-steal-1-01m-from-tranche-vault-on-avalanche
- - https://defillama.com/hacks

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrjHoMJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmfPZ9YsI6XplZByGLAekhUHskn33yKHZ5S14/mZ
AVv5yxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAC/mgEApyN0jQjmOVx8xaJS
EUCuHSRQG2EfPPhs2NjikjaznGIBALBqn+udxQJHkWbgehT5Jws22gVktSYe
+F8A9geG2aYH
=YdIi
-----END PGP SIGNATURE-----