An attacker used a flash loan to manipulate CoreVault's price oracle on BNB Smart Chain and drained the protocol's InsurancePool of 160.26 BNB, according to on-chain monitoring by TenArmorAlert. CertiK's security dashboard values the haul at approximately $112,200, while other research cites roughly $112,300 for the same amount. The incident occurred on November 4, 2026.
How the attack worked
Flash loans allow an attacker to borrow large sums without collateral, provided the loan is repaid within the same transaction. This gives temporary buying power with minimal upfront capital, limited only by borrowing fees and gas costs.
The second component was the oracle, the price feed a smart contract relies on to determine asset values. If that feed depends on a source that a large trade can move—such as a thin liquidity pool—a borrowed fortune can briefly push the price to a manipulated level. The contract then accepts that distorted price as accurate.
In CoreVault's case, the manipulated price allowed the attacker to redeem far more than their position should have permitted. A redemption that should have paid out one unit's worth reportedly paid out up to 33 units' worth. The excess came from the InsurancePool. After extracting the value, the attacker repaid the flash loan, leaving the 160.26 BNB as profit.
A familiar pattern in DeFi security
Flash-loan oracle manipulation is a well-documented category of DeFi attack, targeting protocols whose pricing can be pushed around to enable over-redemption and under-collateralized withdrawals. Measured against larger incidents in 2026, the CoreVault loss is considered modest, but the target matters: an insurance pool exists to absorb shocks, and watching it get emptied highlights the risk.
As of the latest reporting, no detailed post-mortem had been published, and there were no major announcements about recovery efforts or how the protocol plans to respond.
What this means for users and protocols
For anyone holding a position in CoreVault, the immediate question is how the drained InsurancePool affects their own coverage. A depleted backstop means less cushion if something else goes wrong, and users should watch for any official communication on how losses will be handled.
The next things to watch are straightforward: whether CoreVault publishes a post-mortem, whether it outlines any plan to replenish the InsurancePool, and whether the stolen 160.26 BNB moves through on-chain channels that monitoring firms like TenArmorAlert can trace.
A 33x redemption inflation is a striking number for a modest dollar loss. It shows how far a single bad price can stretch a contract's logic when nobody designed it to doubt what it was told.
