InsurancePool and CoreVault Attacked on BSC
The InsurancePool and CoreVault contracts on BSC were exploited, leading to a loss of approximately $112,300. The attacker utilized a flash loan to manipulate liquidity pool prices and inflate a redemption value.
On November 3, 2026, the InsurancePool and CoreVault contracts on the Binance Smart Chain (BSC) were targeted in an attack that resulted in a financial loss of around $112,300. The attacker employed a flash loan to manipulate the prices of liquidity pools and oracles, which allowed them to inflate a CoreVault redemption by approximately 33 times. This manipulation enabled the extraction of excess funds from the InsurancePool before the loan was repaid.
The incident involved a single address on the BSC chain, which is relevant for tracing the flow of funds post-incident. The use of a flash loan indicates a sophisticated approach to exploiting vulnerabilities in the liquidity mechanisms of the contracts involved. The manipulation of redemption values highlights potential weaknesses in the price oracles utilized by these contracts.
The on-chain record reflects the transaction details associated with the attack, including the address involved. This information may assist in understanding the movement of funds and the methods used in the attack.
Addresses in this incident
| Address | Chain | Role | Check |
|---|---|---|---|
| 0xD3565b191b28B49Cc517189B984dacDB1FF05304 | BSC | mentioned in coverage | Check live |
Roles are attributed to the source that stated them. Addresses without an attributed role are listed because coverage mentioned them, not because we assign them a part in the incident.