TranchePool: the Avalanche drain and the unresolved cross-chain link

ChainBounty · Investigation analysis · 31 October 2026

A SentinelTX report records 1,013,353.611686 USDC leaving an Avalanche contract at 00:00:03 UTC on 28 October 2026, followed by forwarding to a wallet and two subsequent USDC burns. Public reports cited in the PDF associate the contract with a TranchePool linked to Fence Finance, Valinor Digital and Oatfi. Those affiliations are reported leads, not independently established ownership findings.

The strongest story is not a seamless trail across three chains. It is an Avalanche sequence alongside a separate Ethereum activity record, with the connection between them unresolved. The PDF also contains conflicting confidence labels and a route whose timing cannot support its stated direction. This article keeps those limits visible rather than presenting a complete, verified cash-out path.

1. Roles before routes

The report distinguishes the contract that sent the USDC, the intermediate contract, and the wallet that received it. These are on-chain roles—not identified people. Short reference IDs below organize the PDF's records; the full identifiers appear in the appendix.

• Role: A1 — source contract — Description in the report: Sender of 1,013,353.611686 USDC. Its identification as the victim TranchePool comes from attributed search snippets.
• Role: A2 — intermediate contract — Description in the report: Received the source-contract transfer and forwarded 1,013,353.611687 USDC to A3 in the same transaction, E1.
• Role: A3 — Avalanche wallet — Description in the report: Recipient of that forwarding transfer; recorded creator of A2; sender in the two later burn transactions E2 and E3. Identity not established.
• Role: A4 — Ethereum address — Description in the report: Reported receiver examined separately. The PDF does not establish common control with A3 or an end-to-end path from the Avalanche burns.
• Role: Report scope — Description in the report: Narrative examines 27–31 October 2026; the query appendix reports broader 34-day lookbacks. Neither is a claim of complete coverage.

The difference between the two E1 amounts is retained exactly: 1,013,353.611686 USDC left A1; 1,013,353.611687 USDC reached A3 from A2. They are distinct transfer legs, not interchangeable loss figures. The report states incident loss using the first leg only. It does not add the forwarding, burn, mint, swap and mixer figures together.

2. What the Avalanche record describes

On 27 October, A3 received 100.0 AVAX at 22:42:23 UTC and 11.8294 AVAX at 22:45:24 UTC from an address labelled “KuCoin, Exchange” in the report's label database. The direction was exchange-labelled address to wallet. It is a funding relationship, not proof of an account holder's identity or exchange involvement in the incident.

The report's transaction-list record places A2's creation at 23:41:49 UTC. A staging call followed at 23:56:41 UTC. Its retained rows describe a USDC cycle involving an Aave-labelled contract, A2 and A1, with 1,013,353.611686 USDC on three legs and 1,013,860.288492 USDC returned on another. The PDF interprets the difference, 506.676806 USDC, as consistent with a flash-loan premium. Raw receipt logs were not returned for this staging transaction, so that interpretation remains qualified.

E1 is recorded at 28 October, 00:00:03 UTC, immediately after the UTC day boundary. The PDF describes the source-contract transfer to A2 and the forwarding to A3 in that same transaction. It then records two later burns:

• Burn record: E2 — Quantity and time: 250,000.175563 USDC at 00:03:41 UTC on 28 October 2026; block 98731831.
• Burn record: E3 — Quantity and time: 763,374.836640 USDC at 00:05:22 UTC on 28 October 2026; block 98731940.
• Burn record: Combined burns — Quantity and time: 1,013,375.012203 USDC. This is an outgoing-flow total, not an additional loss.
• Burn record: Difference from A3's E1 receipt — Quantity and time: Burns exceeded the 1,013,353.611687 USDC receipt by 21.400516 USDC. The report does not establish the source of that additional amount.

Figure 1. The two USDC burn amounts recorded for A3. The total is a disposition flow, not a second incident-loss figure.

Color key: slate marks the first burn; sage marks the second. UTC labels and exact quantities distinguish them without color.

Source: SentinelTX, CASE-ASYNCFF1, 31 October 2026, pp. 6–8 and 19–21. Source confidence qualifications are retained in the note below.

In each burn transaction, the PDF describes a transfer to a Circle-labelled address, a burn event and a transfer to the zero address. Both message payloads contained matching destination words and the ASCII string “cctp-forward.” The report interprets the byte layout as consistent with a destination on Solana, but it did not obtain a decoder result or establish that the destination word matched the reported Solana address.

Diagram 2. The report's same-chain transfer and burn sequence. Equal-width arrows show sequence and direction, not value or elapsed time. The onward cross-chain connection is not established; no continuous Avalanche-to-Ethereum route is asserted.

Color key: slate marks the source outflow and forwarding; sage marks later burns. Color does not indicate verification.

Address / role key: the graphic's P1 corresponds to A1, C1 to A2 and W1 to A3 in this article. B1 denotes burn operations through `0xfd78ee919681417d192449715b2594ab58f5d002`, with transfers to the zero address—not an attributed owner. Full A1–A3 addresses are in the appendix.

Source: SentinelTX, CASE-ASYNCFF1, pp. 4–7, 19–20 and 33. The earlier staging transaction must not be treated as downstream proceeds of the later drain.

3. A separate Ethereum record, not a completed bridge trace

For A4 on 28 October, the PDF records six USDC mints totalling 1,021,502.948496 USDC, five transfers to a CowProtocol-labelled settlement contract, and eleven deposits totalling 432.2 ETH into four Tornado.Cash-labelled pools. The mint aggregate, the five settlement-leg amounts and the mixer aggregate are explicitly marked unverified for exhibit purposes in the report's limitations.

The five settlement quantities are 100,005.0; 200,000.0; 300,000.0; 350,000.0; and 71,497.948496 USDC. The recorded ETH deposit pattern is four deposits of 100.0 ETH, three of 10.0 ETH, two of 1.0 ETH and two of 0.1 ETH. These figures describe the Ethereum address's recorded activity. They do not establish that all of it came from the Avalanche incident.

The PDF makes three boundaries explicit:

• No established bridge completion. Solana activity was not read, and the Avalanche-to-Solana-to-Ethereum connection is not transaction-hash anchored.
• No reconciled provenance. The reported Ethereum mint total exceeds the Avalanche burn total by 8,127.936293 USDC. The source does not resolve the difference or attribute the entire Ethereum amount to this case.
• No identified common controller. No retrieved shared gas funder, common deployer or domain cluster establishes that A3 and A4 were controlled by the same party.

The report describes CowProtocol settlement as non-custodial, despite the database's “Exchange” label. It does not report a custodial exchange deposit by a case wallet within the traced scope. Likewise, a Tornado.Cash label identifies the report's attributed destination; it does not identify a depositor or establish a current legal designation.

4. Mechanism: three hypotheses, not a proven root cause

The source offers three explanations from attributed search-result snippets: a day-rollover settlement calculation, inflated tranche shares minted using flash-loan capital, and a permissionless “double-draw” caused by borrowing logic that failed to subtract unpaid matured principal. It attributes these respectively to SlowMist, Blockaid, and DeFiHackLabs/web3VE reporting. The source pages were not read by the investigation, and none of these hypotheses was verified against contract source code.

SentinelTX treats the hypotheses as potentially complementary. The timing at 00:00:03 UTC and the earlier staging cycle are the observations behind that interpretation; they do not by themselves prove the contract defect. The PDF also preserves a date discrepancy: one cited snippet dates the drain to 27 October, while its recorded block timestamp places it just after midnight on 28 October.

A separate timing problem matters more than the calendar label. One route in the report places a later hop at block 98731443 before the block 98731606 flow that supposedly feeds it. That ordering cannot establish the claimed causal path. The earlier staging activity should not be presented as proceeds of the later drain, and this article does not use that route to connect the two.

5. Conclusion: a bounded record, with the missing connection still missing

The PDF records the Avalanche source-contract outflow, forwarding and two subsequent burns. It also records separate Ethereum mint, settlement and mixer activity. The unresolved link between them is central—not a minor footnote. The report does not establish the identity behind the addresses, the definitive root cause, activity at the reported Solana receiver, or common control across the Avalanche and Ethereum wallets.

Its proposed next leads are issuer-side attestation and forwarding records, exchange withdrawal records for the initial funding, and a completed Solana record. Those are recommendations in the source, not actions completed for this article. No recovery or freeze outcome is claimed.

Figure 3. What the report records and what it leaves unresolved. Its narrative conclusion and structured transfer rows carry conflicting confidence labels; this summary does not upgrade either into a clean end-to-end finding.

Color key: slate distinguishes headings only; it is not a confidence or risk scale.

Source: SentinelTX, CASE-ASYNCFF1, pp. 19–20 and 33.

6. Reference appendix and source qualifications

Selected transaction records

• Reference: E1 — source outflow and forwarding — PDF record: Avalanche transaction `0x3f6b23292a2e9c2956c7ac56d0b1f79b0271b49edec2156d2675ddf1de058c77`; 2026-10-28T00:00:03Z; block 98731606. A1 → A2: 1,013,353.611686 USDC. A2 → A3: 1,013,353.611687 USDC. PDF pp. 4–7 and 20.
• Reference: E2 — first burn — PDF record: Avalanche transaction `0x0e974743161ddb166d5ad698b9a2b0c9ca2ddf5f569a532e6c5665ce2c92218b`; 2026-10-28T00:03:41Z; block 98731831; 250,000.175563 USDC. PDF pp. 6–7.
• Reference: E3 — second burn — PDF record: Avalanche transaction `0x51bb85e171585a2ec7ec7bd918cd6a08e916e38f79cf2a17b5e5211ee3b9f397`; 2026-10-28T00:05:22Z; block 98731940; 763,374.836640 USDC. PDF pp. 6–7.

Address and role register

• Reference: A1 — Address and qualified role: `0xe25cb545bdd47a8ec2d08001cb5661b00d47621a` — Avalanche source contract; victim-TranchePool attribution is a reported lead.
• Reference: A2 — Address and qualified role: `0xf09dcf4ede2a88bd316ff355dfc333a281a57805` — Avalanche intermediate contract.
• Reference: A3 — Address and qualified role: `0x6ff1c3ffa622e1062168f3497a275be9cc2b1246` — Avalanche wallet receiving E1 forwarding and sending E2/E3.
• Reference: A4 — Address and qualified role: `0xdc3d7cc5383e0f1ac46d2c693aad1a19859a2deb` — separately examined Ethereum address; connection to this case remains partial/inferred.
• Reference: Reported Solana receiver — Address and qualified role: `C5L5EtcZmTKFc4D7Ntfqi7MtohnHVh4xZn93a5dBhB8` — not read; neither activity nor absence of activity is established.

Source and limitations note

Source: the 36-page SentinelTX-generated PDF CASE-ASYNCFF1, generated 31 October 2026. This article adapts that report; it is not an independent on-chain audit. The PDF contains no external hyperlinks. No public PDF URL is supplied here.

Confidence conflict: the routing table labels the E1 transfer rows “verified,” while the conclusion begins “unverified (auto-downgraded).” Those source labels are not silently reconciled. The report states that its integrity gate “downgraded 11 claims in the text and flagged 4 findings for review” (p. 4).

Material route warning: “[INV-5] (report-wide) — Hop 0 (block 98,731,606) → Hop 2 (block 98,731,443) is time-inverted” and describes “a causally impossible path (the cash-out tx precedes the deposit tx)” (p. 33). The practical consequence is that this path cannot demonstrate that the earlier payment was funded by the later receipt.

Amount qualifications: seven amounts are unverified for exhibit purposes: the 432.2 ETH aggregate, five CowProtocol legs and 1,021,502.948496 USDC mint aggregate (p. 18). The final warning appendix also flags 432.2286 ETH, 5.0 OVER and the conclusion's 1,021,502.948496 USDC as not bounded by a readable retained quantity (p. 33).

Coverage: the narrative's examined window is 27–31 October, but Appendix A reports two 34-day query windows spanning 27 September–31 October and 138 timestamped retained movement rows from 27 October 22:42:23 to 30 October 22:52:47 UTC. Appendix A both lists timestamped bounds and says exact bounds were not retained; it does not establish that the requested cutoff was enforced. The article does not claim exhaustive period coverage.

Other boundaries: two Solana reads failed; four Avalanche bridge-correlation attempts were unresolved, not negative; Avalanche internal traces were unavailable; the staging transaction lacked returned receipt logs; external reporting was available only as attributed snippets. Graph-wide totals include unrelated flows and are not incident loss. A successful PDF export or signed manifest does not remove these source limitations.