TranchePool Attack Transfers About 1.0134 Million USDC in 202 Seconds
Photo: TokenPost
GCSA said an attacker exploited a cross-day settlement flaw in Avalanche-based TranchePool to transfer about 1.0134 million USDC in 202 seconds. The flaw affected the vault application, not the underlying Avalanche network. A separate finding concerned a phishing campaign that impersonated the identity security@ku.com to pose as KuCoin. GCSA said the campaign tried to induce users to download remote-control software. The domains used lacked DMARC configuration. After GCSA notified KuCoin, the exchange completed remediation and enabled a DMARC quarantine policy. GCSA also flagged a possible software supply-chain risk involving an MCP toolkit referenced in Bitkub's official documentation.
Source: TokenPost
