An Avalanche private-credit pool marked a loan repaid because the calendar said so. Someone collected $1.01M on the difference.
Just before midnight UTC on Oct. 27, an attacker flash-borrowed exactly the TranchePool's USDC balance from Aave, cycled it through the pool, and set a principal repayment due at 00:00:00. SlowMist ties the pool to Valinor Digital, Oatfi and Fence Finance.
At the rollover, the pool booked that payment as received. No USDC arrived. Three seconds later the same draw went through again and took all 1,013,353 USDC, which left for Solana over CCTP within minutes. Fence has offered a 10% bounty onchain. No return confirmed yet.
Onchain credit imported the due dates. It skipped the back office that checks whether anyone paid.