TranchePool Attack Transfers About 1.0134 Million USDC in 202 Seconds

GCSA said an attacker exploited a cross-day settlement flaw in Avalanche-based TranchePool to transfer about 1.0134 million USDC in 202 seconds. The flaw affected the vault application, not the underlying Avalanche network. A separate finding concerned a phishing campaign that impersonated the identity security@ku.com to pose as KuCoin. GCSA said the campaign tried to induce users to download remote-control software. The domains used lacked DMARC configuration. After GCSA notified KuCoin, the exchange completed remediation and enabled a DMARC quarantine policy. GCSA also flagged a possible software supply-chain risk involving an MCP toolkit referenced in Bitkub's official documentation. After the original package was removed, a third party re-registered its npm package name. GCSA warned that installing the package without pinning its version, or using plaintext keys, could expose credentials.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to TokenPost.