InsurancePool/CoreVault

What happened

On November 3, 2026, the InsurancePool and CoreVault contracts on BSC were attacked, resulting in a loss of approximately $112,300 (about 160.26 BNB). The attacker used a flash loan to manipulate liquidity pool prices/oracle, inflating a CoreVault redemption by about 33 times to extract excess funds from the InsurancePool before repaying the loan.

Details

Date

Nov 3, 2026

Kind

Hack or exploit

Method

Flash Loan Attack

How in

Price, oracle and governance

Target

DeFi protocol or token (estimate: SlowMist chain category)

Chains

BNB Chain

What would have stopped it all controls for this way in

• Prices never come from one pool's spot reserves: use a time-weighted average or an aggregated feed.
  Check: Every price read is listed with its source; none reads current reserves.
• A bounty and negotiation channel is ready, with an on-chain message to the attacker in the first hour.
  Check: A prepared message, a bounty figure agreed in advance, a person who can send it.

General guidance for this kind of attack, not a finding about this incident.

How sure: 0 of 4 checks what the checks mean

• Witnessesone source so far
• Same storyneeds a second source
• Blockchain receiptno public attack transaction checked
• Official wordno official statement linked

Who says what

• SlowMist Hacked ↗$112K

Figure used: $112K, the figure SlowMist Hacked gives. Each source's own figure is in dollars at the time.

Related incidents