BNB Chain Flash Loan Exploit Drains $111K From InsurancePool and CoreVault
Key Takeaways
- •The attacker borrowed approximately $143.6 million in Wrapped BNB through a flash loan from Lista DAO's Moolah platform.
- •Large swaps distorted liquidity pool prices, enabling an inflated withdrawal of 260.21 BNB, valued at roughly $180,300, from InsurancePool via CoreVault.
- •After reversing the trades and repaying the flash loan in the same transaction, the attacker kept a net gain of about 160.26 BNB before gas expenses.
- •The targeted pool suffered an estimated loss of approximately 179.5 BNB, worth around $111,000.
- •The exploit highlights the security risks of DeFi protocols that derive withdrawal valuations from on-chain liquidity prices instead of independent or smoothed price oracles.
A price manipulation exploit targeting InsurancePool and CoreVault on BNB Chain resulted in losses of approximately $111,000 after an attacker used a large flash loan to distort liquidity prices and trigger an inflated withdrawal, according to blockchain security monitoring platform OnchainLens.
The attacker borrowed roughly $143.6 million worth of Wrapped BNB (WBNB) — the tokenized form of BNB widely used across BNB Chain's decentralized exchanges and lending markets — through Lista DAO's Moolah platform before executing a series of large trades designed to distort market prices. The manipulation enabled the attacker to withdraw substantially more BNB from the targeted pool than prevailing conditions would ordinarily permit.
The incident highlights continuing security risks facing decentralized finance (DeFi) protocols that rely on liquidity prices and external market activity to calculate withdrawals and redemptions.
Flash Loan Used to Manipulate BNB Chain Prices
The attack began with the attacker obtaining approximately $143.6 million in WBNB through a flash loan facilitated by Lista DAO's Moolah. Flash loans allow users to borrow substantial amounts of cryptocurrency without posting conventional collateral, provided the borrowed funds are returned within the same blockchain transaction.
The mechanism is widely used in decentralized finance for arbitrage and other legitimate trading strategies. However, vulnerabilities in pricing mechanisms can also allow attackers to use flash loans to manipulate market conditions temporarily. That risk stems from how many on-chain markets price assets: valuations are derived from the token balances held in a liquidity pool at the exact moment a transaction executes, which leaves room for large swaps to push quoted prices far from broader market levels within a single transaction.
After securing the borrowed WBNB, the attacker conducted large swaps to distort liquidity prices within the targeted ecosystem. These transactions altered the price conditions used by the affected protocols to determine the value of assets available for withdrawal.
By temporarily manipulating liquidity prices through large swaps, the attacker exploited the valuation mechanism behind InsurancePool and CoreVault to trigger an inflated redemption on BNB Chain. The price distortion created an opportunity to withdraw assets at a value that did not accurately reflect the underlying liquidity conditions.
Inflated Withdrawal Resulted in Pool Losses
Following the price manipulation, the attacker triggered a withdrawal of 260.21 BNB, valued at approximately $180,300 at the time of the incident. The withdrawal formed the central stage of the exploit, as the manipulated pricing conditions allowed the attacker to extract assets from the targeted pool at an inflated valuation.
After completing the withdrawal, the attacker reversed the earlier trades to restore the prior market state. This step unwound the temporary price distortion while allowing the attacker to recover the funds needed to settle the flash loan. The borrowed WBNB was subsequently repaid within the same transaction, satisfying the flash loan's repayment requirement.
The disparity between the roughly $143.6 million borrowed and the approximately $111,000 extracted illustrates the economics of this attack class: because flash loans require no collateral and the principal is returned before the transaction closes, an attacker can deploy institutional-scale capital for the duration of a single transaction without needing to own it.
According to the reported transaction figures, the attacker retained a net gain of approximately 160.26 BNB before accounting for gas expenses. The targeted pool, meanwhile, suffered an estimated loss of approximately 179.5 BNB, valued at around $111,000.
OnchainLens documented the attack sequence in a post on X:
INSURANCEPOOL / COREVAULT EXPLOITED FOR ~$111K ON BNB CHAIN
An attacker appears to have used flash loan price manipulation to trigger an inflated redemption payout.
Attack sequence:
- Borrowed ~$143.6M in WBNB via Lista DAO's Moolah.
- Manipulated liquidity pool prices through large swaps.
- Triggered a 260.21 BNB (~$180.3K) withdrawal from InsurancePool via CoreVault.
- Reversed swaps and repaid the flash loan.
- Walked away with 160.26 BNB ($111K) before gas.
InsurancePool's net BNB depletion was ~$179.5K.
DeFi Pricing Mechanisms Face Renewed Security Concerns
The incident demonstrates how flash loans can amplify vulnerabilities in decentralized finance protocols when pricing and withdrawal mechanisms are exposed to temporary liquidity distortions. Price manipulation executed through flash loans has become a recurring exploit pattern across the industry, since protocols that read valuations directly from on-chain pool prices inherit the sensitivity of those prices to whatever trades execute immediately before them.
Flash loans themselves are not inherently malicious. They provide access to capital without traditional collateral requirements and support a range of legitimate decentralized trading activities. However, attackers can exploit weaknesses in price calculations by borrowing large amounts, executing trades that influence market valuations, and withdrawing assets before reversing those transactions.
Protocols that rely heavily on liquidity-based pricing mechanisms may face particular risks if their systems cannot adequately distinguish between temporary market distortions and sustainable asset valuations. This is one reason oracle design is treated as a core security decision: oracles that aggregate external market data or smooth prices over time are generally less sensitive to single-transaction distortions than figures read directly from a liquidity pool.
The exploit also underscores the importance of safeguards such as independent price oracles, withdrawal limits, liquidity protections, and transaction-level monitoring. These mechanisms can help reduce the likelihood that temporary price movements will result in unauthorized or excessive asset withdrawals.
The approximately $111,000 incident illustrates the financial risks of inadequate price protection in decentralized finance, particularly when attackers can combine flash loans with large-scale market manipulation.
Security Monitoring Remains Critical for DeFi Platforms
The InsurancePool and CoreVault exploit adds to the security challenges facing decentralized finance platforms operating across multiple blockchain networks. As DeFi applications manage increasingly complex liquidity arrangements and interconnected financial services, weaknesses in individual protocols can create opportunities for attackers to extract funds through carefully structured transactions.
The reported incident also illustrates the value of real-time blockchain monitoring in identifying suspicious borrowing, trading, and withdrawal activity. In this case, the full sequence — borrow, swap, withdraw, reverse, repay — was reconstructed and published by OnchainLens, giving other protocol teams a concrete reference for the pattern their safeguards need to detect.
For protocol developers, strengthening price validation and preventing abnormal liquidity movements will remain essential to protecting user funds. The effectiveness of these safeguards could play an important role in maintaining confidence in decentralized financial applications.
Source: CoinTrust
