An attacker exploited a cross-day settlement flaw in the Avalanche-based TranchePool vault application to steal about 1.0134 million USDC within 202 seconds. This vulnerability affected only the vault app, not the Avalanche network itself. The attacker used flash loans and repeated withdrawals to carry out the theft. Separately, a phishing campaign impersonated KuCoin to trick users into downloading remote-control software, prompting KuCoin to improve its email security with a DMARC quarantine policy. Additionally, a potential software supply-chain risk was identified involving an MCP toolkit referenced by Bitkub, though no theft was detected. Relevant platforms were notified and analyses published.
KuCoin Token (KCS) trades at Rp128.398 on Pluang, down 2.14% in the last day as of Nov 07, 2026 03:21 WIB. The token's market cap stands at Rp17,96 trillion with a 24-hour volume of Rp83,17 million. Pluang users show 100% sell activity and hold KCS for an average of 36 days. This trading behavior occurs alongside KuCoin's recent security improvements following phishing threats.
