InsurancePool on BNB Chain Drained of 260.21 BNB in Flash Loan Attack

260.21 BNB Leaves InsurancePool

Some 260.21 BNB, worth about $180,300 at the time of the transfer, left an InsurancePool contract on BNB Chain on November 4 after a flash loan attack forced an oversized redemption payout, and on-chain figures put the pool's net depletion of BNB at roughly $179,500. The BNB price itself was not the object of the manipulation; the attacker distorted a price read inside one protocol rather than the coin's market rate, and both security firm CertiK and the on-chain analysis account Onchain Lens flagged the exploit within hours of the transfers. The DeFi insurance contract sat behind CoreVault, a vault that prices redemptions off the market it reads, and that read is where the attack landed. The reconstructed sequence begins with a loan: the attacker borrowed about $143.6 million in wrapped BNB (WBNB) through Moolah, the lending market operated by Lista DAO. A flash loan is collateral-free and must be repaid inside the same transaction, which is what lets a wallet rent buying power of that size for a few seconds. The borrowed WBNB then went into very large swaps against a liquidity pool, dragging the pool's internal exchange price away from the market. Because a pool prices swaps mechanically from its own reserves, a trade large enough can move the quoted figure wherever the trader wants. WBNB is the wrapped form of BNB that makes the coin usable across DeFi services on the chain. CertiK's analysis puts the resulting inflation at about 33 times the redemption's normal size, which is how the vault ended up paying out 260.21 BNB against a pool holding BNB reserves. After the withdrawal, the attacker reversed the swaps, repaid the $143.6 million loan and finished with 160.26 BNB, roughly $111,000, in profit before gas. No figure in this sequence has yet been confirmed by the pool's own operators; it all rests on third-party on-chain measurement.

Inside the 33x Redemption Payout

Redemption is the operation the attacker abused: the contract exchanges a position back for the underlying asset at a rate it calculates itself. CoreVault calculated that rate from the manipulated liquidity pool's price, so the oversized swaps directly determined what the InsurancePool had to pay, and CertiK's alert describes the result as a flash-loan-funded oracle attack that pushed the CoreVault redemption to about 33 times its normal size. The trick is not exotic DeFi engineering; it is a contract reading a single pool's instantaneous price as an oracle. Once the price was dragged, the withdrawal of 260.21 BNB, about $180,300, followed through CoreVault, after which the attacker ran the swaps in reverse, settled the $143.6 million Moolah loan inside the same transaction, and kept roughly 160.26 BNB, near $111,000, before gas. Every step, borrow, swap, redeem, unswap and repay, sat inside one block. The on-chain trail is public. The block explorer record timestamps the 260.21 BNB transfer at 6:50:20 Japan time on November 4, which is 21:50:20 UTC on November 3, and Onchain Lens laid out the full five-step sequence in its on-chain breakdown. The same account published the wallet that initiated the attack together with the addresses it routed funds to, so anyone can follow those wallets directly on the explorer while any further movement happens. CertiK raised its own security alert on the incident the same day. Neither the InsurancePool nor the CoreVault operators have issued an official loss report, an update on recovery of the outflow, or a post-mortem. Until one appears, the confirmed picture stops at the on-chain transfers, and the $179,500 net depletion remains a third-party measurement rather than the team's own accounting. The episode adds to the exploit tally that has built up around the BNB ecosystem and across the wider altcoin market this quarter.

On-Chain Trail, No Team Post-Mortem

The root cause is established well enough by the on-chain evidence and CertiK's analysis: a redemption engine priced from a single pool's spot number is an oracle that anyone with a large enough flash loan can write to, and a 33x payout shows the write is profitable even after borrowing $143.6 million for a few seconds. The standard remediation in incidents of this shape, pricing redemptions from time-weighted or multi-venue feeds and capping single-redemption outflows, remains unconfirmed here because neither operator has disclosed any change. Until a team post-mortem appears, the confirmed record stays narrow, and it is where the number should rest: 260.21 BNB, about $180,300, came out of the InsurancePool, the pool ended roughly $179,500 lighter, and 160.26 BNB reached the attacker.