Flash-loan oracle attack inflates CoreVault redemptions 33x, drains 160.26 BNB
英文原文查看译文
阅读字号阅读正文 ↓
加载图片中
The attack highlights vulnerabilities in DeFi protocols, emphasizing the need for robust oracle security to prevent future financial exploits.
An attacker on BNB Smart Chain borrowed big, bent a price feed, and walked off with the contents of an insurance pool
Tue 3 Nov 2026 · 21:36 EST · 3 min read
In Finance
Share
An attacker used a flash loan to manipulate CoreVault’s price oracle on BNB Smart Chain, then drained the protocol’s InsurancePool of 160.26 BNB.
CertiK’s security dashboard puts the haul at about $112,200. The pool built to cover losses ended up as the loss.
The incident took place on November 4, 2026, and was flagged by TenArmorAlert’s on-chain monitoring. The attack reportedly inflated CoreVault redemptions by as much as 33 times before the funds left the InsurancePool.
How the CoreVault exploit worked
A flash loan is the key ingredient. Think of it as a bank that hands you millions with no paperwork, on one condition: you return it within the same transaction.
On a blockchain, a single transaction can hold many steps. If the money isn’t back by the final step, the whole thing reverses as if it never happened.
That gives an attacker enormous, temporary buying power with almost no upfront capital. Their only real cost is the fee to borrow and the gas to run the transaction.
The second ingredient is the oracle. An oracle is the feed a smart contract uses to learn what an asset is worth.
If that feed relies on a source a large trade can move, such as a thin liquidity pool, a borrowed fortune can briefly push the price wherever the attacker wants. The contract then reads that warped price as gospel.
The news moving money, markets, and the world—before your day starts.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
We respect your privacy. Unsubscribe anytime.
In CoreVault’s case, the manipulated price let the attacker redeem far more than their position should have allowed. A redemption meant to pay out one unit’s worth reportedly paid out up to 33 units’ worth.
The excess came from the InsurancePool. Once the attacker had extracted the value, the flash loan could be repaid, leaving the 160.26 BNB as profit.
Reports vary slightly on the dollar value. CertiK’s figure is about $112,200, while research compiled on the incident cites roughly $112,300 for the same 160.26 BNB.
The gap is small and likely reflects BNB’s price at the moment each estimate was taken. The BNB count is the more stable number to watch.
A familiar pattern in DeFi security
Flash-loan oracle manipulation is a well-documented category of DeFi attack, aimed squarely at protocols whose pricing can be pushed around to enable over-redemption and under-collateralized withdrawals.
Measured against larger incidents in 2026, the CoreVault loss is considered modest. A six-figure drain does not make headlines the way nine-figure exploits do.
Still, the target matters. An insurance pool exists to absorb shocks, so watching it get emptied is a bit like learning the fire extinguisher was the thing that caught fire.
As of the latest reporting, no detailed post-mortem had been published. There were also no major announcements about recovery efforts or how the protocol plans to respond.
What this means for users and protocols
For anyone holding a position in CoreVault, the immediate question is how the drained InsurancePool affects their own coverage. A depleted backstop means less cushion if something else goes wrong, and users should watch for any official communication on how losses will be handled.
The next things to watch are straightforward. Whether CoreVault publishes a post-mortem, whether it outlines any plan to replenish the InsurancePool, and whether the stolen 160.26 BNB moves through on-chain channels that monitoring firms like TenArmorAlert can trace.
A 33x redemption inflation is a striking number for a modest dollar loss. It shows how far a single bad price can stretch a contract’s logic when nobody designed it to doubt what it was told.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.