On November 4, 2025, a previously unremarkable insurance and treasury module on the BNB Chain suddenly caught the monitoring radar—Onchain Lens and CertiK Alert issued warnings one after another, and several Chinese media outlets reported, pointing to the same target: InsurancePool and CoreVault allegedly suffered a combined attack of "flash loan + price manipulation." According to on-chain analysis, the attacker borrowed funds in a very short period, distorted the liquidity pool price, thus amplifying the amount of a redemption request in CoreVault, ultimately profiting approximately 160.26 BNB, which is around 110,000 US dollars; however, Deep Tide TechFlow quoted data from Onchain Lens stating that InsurancePool had a net loss of about 179,500 US dollars equivalent in BNB, presenting a striking contrast of "110,000 in gains and nearly 180,000 in losses," while the gap in between has yet to receive an authoritative explanation. On the same day, Jinse Finance recorded that the BNB price briefly dropped below 690 US dollars, hitting a low of about 689.82 US dollars, with a 24-hour decline of about 1.16%. However, the existing information does not prove a direct causal relationship between this price fluctuation and the attack.
Flash Loan Day Script: Redemption Amplified 33 Times
According to Onchain Lens, this attack began with a flash loan: the attacker quickly borrowed a large amount of funds within a single block, then targeted the liquidity pools related to InsurancePool and CoreVault. In a very short time, the attacker, through concentrated buying or selling, pushed the pool price to a favorable position for themselves, thus affecting the oracle readings that relied on that price source, writing an instantaneous price on-chain that was disconnected from the real market, laying the groundwork for subsequent abnormal redemptions.
CertiK Alert provided more dramatic details: at the moment when the price was distorted, the attacker initiated a redemption of CoreVault shares, which was originally supposed to be a normal-sized exit but was amplified to about 33 times the redemption amount. This amplified redemption was not paid out of the attacker's pocket but directly connected to the payout or protection logic of InsurancePool, leading to the rapid depletion of the insurance pool in a single transaction. The entire process falls within the recurring "flash loan + oracle (price) manipulation" attack paradigm in the DeFi space, but the publicly available materials have not disclosed specific transaction hashes and addresses; the relevant details mainly come from the public statements of a few monitoring entities like Onchain Lens and CertiK, compelling external observers to accept the reality that the information remains incomplete in reviewing this incident.
110,000 Gains vs. 180,000 Losses: The Tension of Loss Metrics
From the figures provided by various parties, the "accounts" of this attack were misaligned from the start. Multiple sources, including Onchain Lens and CertiK, indicated that the attacker ultimately profited approximately 160.26 BNB, with some media estimating this as about 111,000 US dollars at the time of the incident, while CertiK provided an estimate of around 112,200 US dollars. The differences mainly stem from the choice of price points and rounding methods, but generally, they are locked in around the 110,000 US dollar level. In contrast, Deep Tide TechFlow cited Onchain Lens to point out that the net loss of InsurancePool in this incident was about 179,500 US dollars equivalent in BNB, and this metric has currently seen only a single source report, implying a gap that has yet to be clearly explained between the two groups of numbers: "the attacker gained 110,000" and "the pool lost nearly 180,000."
This situation of "profit less than protocol net loss" is not uncommon in DeFi attack recaps: the mix might include arbitrageurs passively involved, ordinary users liquidated or forced to transact at abnormal prices, and bad debts and asset discrepancies borne by the protocol itself, among other factors. However, these are merely common scenarios. In this BNB Chain incident, the publicly available materials have not provided detailed accounts of the fund flows, nor have there been official assessments of losses from the project party. It remains completely blank as to the specific components that constitute the difference between 110,000 and 180,000, and in the absence of information, the tension of this set of figures itself becomes an uncertainty that external observers cannot avoid.
Insurance Pool and Treasury Become Targets: Oracle as a Weak Link
From a design perspective, InsurancePool was created to backstop risk exposure, while treasury modules like CoreVault are responsible for handling redemptions and asset allocations, with both standing at the end of the protocol risk chain. Once there is a deviation in the price input, it will be amplified into a real funding gap. According to monitoring entities like Onchain Lens and CertiK, in this attack, the attacker first leveraged the liquidity pool through a flash loan, quickly shifting the on-chain price of the target asset to a position favorable to themselves, and then triggered a redemption through CoreVault, with the single amount amplified by about 33 times, directly releasing the loss that should have been borne by InsurancePool all at once. Since public information has not disclosed which oracle was specifically used, or whether there are multi-source prices or time-weighted mechanisms, external observers can currently only see the result: InsurancePool and CoreVault became the first modules to "take the blame" once the price was distorted.
This is not an isolated incident but rather a combination that is repeatedly staged in DeFi security narratives: flash loans provide instantaneous, large amounts of borrowed funds, and oracles become a breakthrough point when liquidity is relatively weak or price sources are too singular. The attacker only needs to push prices up or down within a very short time window to open up parameters that should be stable in the redemption logic, magnifying profits or redemption amounts. This BNB Chain incident continues this pattern; the issue goes beyond any single contract being blown up but serves as a reminder to developers and participants that any insurance pool, treasury, and redemption module reliant on price data must find a balance among multi-source price verification, time dimension smoothing, and redemption caps. Otherwise, in the face of the old combination of "flash loans + oracle," the so-called risk buffer layer may still be emptied within several blocks.
BNB Drops Below 690 US Dollars On the Same Day: Market Reaction Limited
From market performance, this on-chain incident of the insurance pool being emptied did not immediately cause violent fluctuations in the spot price. Jinse Finance reported that on the day of the incident, the BNB price briefly fell below 690 US dollars, with a low of about 689.82 US dollars, reflecting a 24-hour decline of about 1.16%. Such fluctuations, when viewed on a daily scale, are closer to a small pullback within a conventional range rather than a crash triggered by a singular black swan event. More critically, the publicly available materials have not established a direct causal link between this on-chain attack and the day's price fluctuations. Currently, there are no announcements from the project party or market data reports attempting to attribute this marginal decline of over 1% directly to the security incident of InsurancePool and CoreVault, making the price trend seem more of a reflection of market sentiment background rather than the “spot pricing” of the attack itself.
In terms of scale, this mismatch of "on-chain incident—moderate market response" is not difficult to understand. Various parties estimated based on on-chain data that the attacker profited around 160.26 BNB, equivalent to about 110,000 US dollars, while Deep Tide TechFlow quoted Onchain Lens indicating that InsurancePool had a net loss of about 179,500 US dollars equivalent in BNB. Whether associated with the attacker’s profits or the pool’s losses, this magnitude is still considered a medium to small scale event in relation to the overall market capitalization of BNB, and its impact focuses more on the security and reputation of the affected protocol itself rather than shaking the pricing foundation of the BNB asset. The market's reaction in price also aligns with this relative scale of reality.
Defensive Lessons: What to Watch for After This Attack
Looking back at this “110,000 triggering 180,000” flash loan incident, the most apparent weaknesses exposed are threefold: first, oracles relying on single or weak price sources lack protection when liquidity pool prices are distorted by a flash loan in a short time; second, the redemption logic of CoreVault is extremely sensitive to short-term prices, where a single price fluctuation can amplify single redemptions by about 33 times, directly draining InsurancePool; third, it remains ambiguous who exactly the insurance pool backs and to what limits, appearing fuzzy in design, and once treated as “unlimited endorsement,” it leaves room for arbitrage for attackers. For any similar protocol, this on-chain script at the very least hints at several lessons: on the price side, introducing multi-source oracles, TWAP, and other time-weighting mechanisms to minimize the impact of instantaneous price manipulation; on the redemption side, limiting single redemption sizes, setting staggered settlements or short delays to allow time for extreme price fluctuations to be corrected; on the risk side, clearly constraining the coverage targets, amounts, and triggering conditions of the insurance pool to avoid “naked backstops.” However, as of now, public information has not revealed the identity of the deployers behind InsurancePool/CoreVault, nor have there been visible actions like contract suspensions, parameter adjustments, or oracle configuration upgrades, leaving ambiguity regarding whether losses have been recovered or if there is any regulatory or judicial intervention. Thus, whether we will see detailed official recaps, substantial changes in subsequent contracts or oracle configurations, and whether the community can develop earlier risk recognition and public pressure capacity when facing similar "flash loan + price manipulation" combinations, will be the real variables worth continuous tracking after this event.
Join our community, let's discuss and grow stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
