InsurancePool and CoreVault lose ~$111K in BNB Chain flash loan attack
Security & Exploits ·
An attacker used a large flash loan to distort liquidity pool prices and extract an inflated redemption from InsurancePool via CoreVault.
An attacker borrowed roughly $143.6M in WBNB through Lista DAO's Moolah lending protocol, using the capital to manipulate liquidity pool prices through large swaps, according to a post on x.com. The price distortion was used to trigger a 260.21 BNB withdrawal, worth approximately $180.3K, from InsurancePool via CoreVault. The attacker then reversed the swaps and repaid the flash loan in full, leaving no outstanding debt from the borrowed WBNB.
After accounting for the cost of executing the manipulation, the attacker walked away with approximately 160.26 BNB, or about $111K, before gas costs. InsurancePool's overall net depletion in BNB terms came to roughly $179.5K, a figure larger than the attacker's final take due to losses absorbed during the price manipulation and swap-reversal process. The full sequence is recorded on-chain in the attack transaction.
The mechanics follow a pattern common to flash loan exploits: borrowed liquidity is used not to hold a position but to temporarily skew pricing within a protocol's dependent contracts, creating a window in which a redemption or withdrawal function pays out more than it should. Because the loan is repaid within the same transaction, the attacker needs no upfront capital beyond gas, and the lending protocol supplying the flash loan, in this case Moolah, is not itself depleted.
The initiating wallet has been identified as 0xD3565b191b28B49Cc517189B984dacDB1FF05304, and the extracted funds have reportedly moved to a separate address, 0x028491B55D0E18aA81aB3324688E42f91BbadaCC. Coverage of the incident currently traces back to two distinct sources tracking the same cluster of activity.
What remains unclear is whether InsurancePool or CoreVault have issued any public response, paused affected contracts, or outlined a remediation plan, and whether the funds at the receiving address have moved further or been frozen by any intermediary. It is also not yet established whether the vulnerability lies in CoreVault's price-dependency logic specifically or in a broader design shared across similar insurance-pool mechanisms on BNB Chain.