A price manipulation exploit targeting InsurancePool and CoreVault on BNB Chain resulted in approximately $111,000 in losses after an attacker used a large flash loan to manipulate liquidity prices and trigger an inflated withdrawal.
According to blockchain security monitoring platform OnchainLens, the attacker borrowed approximately $143.6 million worth of Wrapped BNB (WBNB) through Lista DAO’s Moolah platform before executing a series of large trades designed to distort market prices. The manipulation enabled the attacker to withdraw substantially more BNB from the targeted pool than the available conditions would ordinarily permit.
The incident highlights continuing security risks associated with decentralized finance protocols that rely on liquidity prices and external market activity to calculate withdrawals and redemptions.
Flash Loan Used to Manipulate BNB Chain Prices
The attack began with the attacker obtaining approximately $143.6 million in WBNB through a flash loan facilitated by Lista DAO’s Moolah. Flash loans allow users to borrow substantial amounts of cryptocurrency without providing conventional collateral, provided the borrowed funds are returned within the same blockchain transaction.
This mechanism is commonly used in decentralized finance for arbitrage and other trading strategies. However, vulnerabilities in pricing mechanisms can also allow attackers to use flash loans to manipulate market conditions temporarily.
After securing the borrowed WBNB, the attacker conducted large swaps to distort liquidity prices within the targeted ecosystem. These transactions altered the price conditions used by the affected protocols to determine the value of assets available for withdrawal.
By temporarily manipulating liquidity prices through large swaps, the attacker exploited the valuation mechanism behind InsurancePool and CoreVault to trigger an inflated redemption on BNB Chain.
The price distortion created an opportunity to withdraw assets at a value that did not accurately reflect the underlying liquidity conditions.
Inflated Withdrawal Resulted in Pool Losses
Following the price manipulation, the attacker triggered a withdrawal of 260.21 BNB, valued at approximately $180,300 at the time of the incident.
The withdrawal represented the central stage of the exploit, as the manipulated pricing conditions allowed the attacker to extract assets from the targeted pool at an inflated valuation.
After completing the withdrawal, the attacker reversed the earlier trades to restore the manipulated market conditions. This step helped unwind the temporary price distortion while allowing the attacker to recover the funds required to settle the flash loan.
The borrowed WBNB was subsequently repaid within the transaction, satisfying the flash loan’s repayment requirement.
According to the reported transaction figures, the attacker retained a net gain of approximately 160.26 BNB before accounting for gas expenses.
The targeted pool, meanwhile, suffered an estimated loss of approximately 179.5 BNB, valued at around $111,000.
DeFi Pricing Mechanisms Face Renewed Security Concerns
The incident demonstrates how flash loans can amplify vulnerabilities in decentralized finance protocols when their pricing and withdrawal mechanisms are exposed to temporary liquidity distortions.
Flash loans themselves are not inherently malicious. They provide access to capital without traditional collateral requirements and support several legitimate decentralized trading activities. However, attackers can exploit weaknesses in price calculations by borrowing large amounts, executing trades that influence market valuations, and withdrawing assets before reversing those transactions.
Protocols that rely heavily on liquidity-based pricing mechanisms may face particular risks if their systems cannot adequately distinguish between temporary market distortions and sustainable asset valuations.
INSURANCEPOOL / COREVAULT EXPLOITED FOR ~$111K ON BNB CHAIN ⚠️
An attacker appears to have used flash loan price manipulation to trigger an inflated redemption payout.
Attack sequence:
1. Borrowed ~$143.6M in WBNB via Lista DAO’s Moolah.
2. Manipulated liquidity pool prices through large swaps.
3. Triggered a 260.21 BNB (~$180.3K) withdrawal from InsurancePool via CoreVault.
4. Reversed swaps and repaid the flash loan.
5. Walked away with ~160.26 BNB (~$111K) before gas.InsurancePool’s net BNB depletion was ~$179.5K.
— Onchain Lens (@OnchainLens) November 4, 2026
The exploit also highlights the importance of safeguards such as independent price oracles, withdrawal limits, liquidity protections, and transaction-level monitoring. These mechanisms can help reduce the likelihood that temporary price movements will result in unauthorized or excessive asset withdrawals.
The approximately $111,000 incident underscores the financial risks of inadequate price protection in decentralized finance, particularly when attackers can combine flash loans with large-scale market manipulation.
Security Monitoring Remains Critical for DeFi Platforms
The InsurancePool and CoreVault exploit adds to the security challenges facing decentralized finance platforms operating across blockchain networks.
As DeFi applications manage increasingly complex liquidity arrangements and interconnected financial services, weaknesses in individual protocols can create opportunities for attackers to extract funds through carefully structured transactions.
The reported incident also illustrates the importance of real-time blockchain monitoring in identifying suspicious borrowing, trading, and withdrawal activity.
For protocol developers, strengthening price validation and preventing abnormal liquidity movements will remain essential to protecting user funds. The effectiveness of these safeguards could play an important role in maintaining confidence in decentralized financial applications.
