CoreVault on BNB Chain: flash-loan oracle attack inflates redemption about 33x and drains InsurancePool of about $112K

Summary

CertiK Alert reported that a flash-loan-funded oracle attack on BNB Chain inflated a CoreVault redemption by about 33x and depleted the associated InsurancePool. Per CertiK, the attacker was left with 160.26 BNB (about $112.2K) after reversing the trade. TenArmor separately flagged a suspected attack on the InsurancePool and CoreVault contracts with losses of about $112.3K. The exploit transaction was mined on 3 November 2026 (UTC); CertiK's alert followed on 4 November.

Affected

• CoreVault / InsurancePool contracts on BNB Chain (contract addresses and project team not identified by the sources)
• Fixed in: No fix or post-mortem announced at time of publication

Impact

According to CertiK, the attacker used a flash loan to manipulate the price oracle used by CoreVault, so a redemption paid out roughly 33 times its fair value, with the excess drawn from the InsurancePool. Funds were drained in a single exploit transaction. Exploitation in the wild is confirmed by the sources. No recovery or compensation plan had been announced at time of publication.

Recommended actions

• Do not deposit into or interact with CoreVault / InsurancePool until the team publishes a post-mortem and fix.
• Protocols that price redemptions from AMM spot prices should switch to manipulation-resistant oracles (TWAP or external feeds) and cap per-transaction redemption sizes.
• Wallets, exchanges and screening providers: add the indicators below to monitoring to flag movements of the stolen BNB.

Indicators

• Exploit transaction hash as published by CertiK Alert.
• Attacker EOA and exploit contract are the sender and the contract created by that transaction, as recorded on-chain (BNB Chain receipt for the CertiK-cited transaction, block 131507810).

Source & attribution

This 0xCERT advisory summarises an alert by CertiK Alert: https://x.com/CertiKAlert/status/2117807084939129050, corroborated by TenArmor's alert as reported by Phemex News: https://phemex.com/news/article/insurancepool-and-corevault-contracts-on-bsc-hit-by-suspected-attack-112k-lost-102297. Details may change; refer to the original source for the authoritative record.