Flash-loan oracle attack inflates CoreVault redemptions 33x, drains 160.26 BNB

An attacker on BNB Smart Chain borrowed big, bent a price feed, and walked off with the contents of an insurance pool An attacker used a flash loan to manipulate CoreVault’s price oracle on BNB Smart Chain, then drained the protocol’s InsurancePool of 160.26 BNB. CertiK’s security dashboard puts the haul at about $112,200. The pool built to cover losses ended up as the loss. The incident took place on November 4, 2026, and was flagged by TenArmorAlert’s on-chain monitoring. The attack reportedly inflated CoreVault redemptions by as much as 33 times before the funds left the InsurancePool. How the CoreVault exploit worked A flash loan is the key ingredient. Think of it as a bank that hands you millions with no paperwork, on one condition: you return it within the same transaction. On a blockchain, a single transaction can hold many steps. If the money isn’t back by the final step, the whole thing reverses as if it never happened. That gives an attacker enormous, temporary buying power with almost no upfront capital. Their only real cost is the fee to borrow and the gas to run the transaction. The second ingredient is the oracle. An oracle is the feed a smart contract uses to learn w...