Tuesday, November 3, 2026

InsurancePool / CoreVault Oracle

Funds lost

$112K

Attack type

Flash Loan Attack

Network

BNB Chain

Category

Yield Aggregator

Summary

On November 3, 2026, the InsurancePool and CoreVault contracts on BNB Chain (BSC) were exploited in a flash-loan-driven price oracle manipulation attack. The attacker leveraged a large flash loan to crash a spot market pool, inflating a vault redemption calculation by ~33x. This allowed the attacker to extract 259.09 BNB from the protocol's InsurancePool reserve, walking away with a net profit of 160.26 BNB (~$112,300 USD) after loan repayment.

Details of the Exploit

The root cause was a flaw in the protocol's redemption oracle helper, which fell back to the PancakeSwap v2 spot price when its primary TWAP and time-window samples were unpopulated or uninitialized. Executing via contract 0x92f521a7Fb4bC7Eb5B3951667cE58c261E52f542, the attacker took a massive flash loan of 207,358.41 WBNB (~$143.6M USD) from Lista DAO's Moolah market (0x8f73b65b4caaf64fba2af91cc5d4a2a1318e5d8c). The attacker dumped 195,000 WBNB into the OSK/WBNB PancakeSwap v2 liquidity pool to severely distort the spot price ratio (crashing WBNB price ~98x in the pool), triggered an inflated redemption against CoreVault, and extracted 260.21 WBNB from the reserve pool.

The attacker then unwound the swap position to restore the liquidity pool state, repaid the Lista DAO flash loan in full, and transferred the net 160.26 WBNB profit (~$112.3K USD) to EOA 0xd3565b191b28b49cc517189b984dacdb1ff05304.

Source: De.Fi REKT Database. Data as of November 9, 2026.