On April 19, 2026, a custom rebalancer contract on Avalanche was exploited via an arbitrary external call vulnerability. The attacker abused a public function that executed unchecked external calls while the contract held delegated credit from Aave V3, allowing them to borrow WAVAX on behalf of victims and extract approximately $64K.