InsurancePool / CoreVault Oracle Hack
What happened
On November 3, 2026, the InsurancePool and CoreVault contracts on BNB Chain (BSC) were exploited in a flash-loan-driven price oracle manipulation attack. The attacker leveraged a large flash loan to crash a spot market pool, inflating a vault redemption calculation by ~33x. This allowed the attacker to extract 259.09 BNB from the protocol's InsurancePool reserve, walking away with a net profit of 160.26 BNB (~$112,300 USD) after loan repayment.
The root cause was a flaw in the protocol's redemption oracle helper, which fell back to the PancakeSwap v2 spot price when its primary TWAP and time-window samples were unpopulated or uninitialized. Executing via contract 0x92f521a7…52f542, the attacker took a massive flash loan of 207,358.41 WBNB (~$143.6M USD) from Lista DAO's Moolah market (0x8f73b65b…8e5d8c). The attacker dumped 195,000 WBNB into the OSK/WBNB PancakeSwap v2 liquidity pool to severely distort the spot price ratio (crashing WBNB price ~98x in the pool), triggered an inflated redemption against CoreVault, and extracted 260.21 WBNB from the reserve pool.
The attacker then unwound the swap position to restore the liquidity pool state, repaid the Lista DAO flash loan in full, and transferred the net 160.26 WBNB profit (~$112.3K USD) to EOA 0xd3565b19…f05304.
Attacker Helper Contract:
0x92f521a7Fb4bC7Eb5B3951667cE58c261E52f542Attacker
EOA: 0xd3565b19…f05304
Exploit Transaction Hash: 0x072a10a5…c598b3
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
