Attackers targeted the InsurancePool and CoreVault contracts on BNB Chain on November 4, 2026, using a flash loan to manipulate CoreVault’s price oracle. CoreVault paid 260.21 BNB, worth about $180,300, while the attacker’s profit was approximately 160.26 BNB, or $110,000, before fees. CertiK said the redemption amount rose about 33 times, shifting the loss to the pool designed to cover user shortfalls. TenArmorAlert detected the activity, which was also reported by Odaily, while OnchainLens attributed the apparent exploit to flash-loan price manipulation. No detailed post-mortem, recovery announcement or replenishment plan had been published in the latest reporting.