Attack Overview

On November 4, 2026, an attacker on BNB Smart Chain executed a flash‑loan oracle manipulation that drained CoreVault’s InsurancePool of 160.26 BNB, equivalent to roughly $112,200 according to CertiK’s security dashboard.

The exploit leveraged a flash loan to temporarily acquire large capital, then altered the price feed feeding CoreVault’s smart contract, causing redemption values to inflate up to 33 times the intended amount.

Mechanics of the Flash‑Loan Exploit

A flash loan provides unsecured borrowing that must be repaid within the same transaction, allowing an attacker to wield millions of dollars without upfront collateral, paying only a fee and gas costs.

CoreVault’s oracle sourced price data from a pool with limited liquidity; the borrowed funds pushed the price upward, and the contract accepted the distorted price as accurate, enabling the attacker to redeem far more BNB than their position warranted.

Impact on CoreVault’s InsurancePool

The inflated redemptions drew 160.26 BNB from the InsurancePool, a reserve meant to cover protocol losses, leaving the backstop effectively empty.

Users with positions in CoreVault now face reduced protection against future incidents, and no public post‑mortem or recovery plan has been released by the protocol as of the latest reports.

Context Within the 2026 DeFi Attack Landscape

Flash‑loan oracle manipulation remains a well‑documented attack vector in DeFi, targeting protocols where price feeds can be moved by large trades.

While the CoreVault loss is modest compared with nine‑figure exploits recorded earlier in 2026, the 33‑fold redemption inflation demonstrates how a small dollar amount can still expose systemic vulnerabilities.

Next Steps for Stakeholders

Observers recommend monitoring on‑chain activity for the movement of the stolen BNB, with firms like TenArmorAlert tracking potential transfers.

CoreVault’s community is awaiting a detailed post‑mortem, a plan to replenish the InsurancePool, and any official communication regarding how the loss will be allocated among users.

According to the Cryptobriefing report, the incident was first flagged by TenArmorAlert’s on‑chain monitoring system, which highlighted the abnormal price movement before the funds were transferred out of CoreVault’s insurance pool.

CertiK’s security dashboard estimated the stolen 160.26 BNB at about $112,200, while another research compilation listed a slightly higher valuation of $112,300, reflecting minor price differences at the time of measurement.

The attack underscores how flash‑loan fees and gas costs are the only expenses for the borrower, allowing the attacker to wield millions of dollars temporarily without collateral, a mechanic repeatedly cited as a risk vector in DeFi protocols that rely on thin‑liquidity price oracles.