CoreVault Hit by Oracle Manipulation Attack, CertiK Says
CoreVault was exploited in a flash-loan attack that manipulated an oracle and inflated a redemption by roughly 33 times, according to CertiK Alert’s post. The security firm said the attack drained the protocol’s InsurancePool and left the attacker with 160.26 BNB, a haul it valued at about $112,200.
A flash-loan-funded oracle attack inflated a CoreVault redemption ~33×, depleting InsurancePool and leaving the attacker with 160.26 BNB (~$112.2K) after reversing the trade.https://t.co/ZvaBsWpoR8
CertiK Report Security Dashboard 👇 https://t.co/Yqz3kRVoso
— CertiK Alert (@CertiKAlert) November 4, 2026
The transaction tied to the incident is visible on BscScan, which matches the on-chain movement associated with the exploit. CertiK’s notice points to oracle manipulation as the mechanism behind the drain, with the inflated redemption allowing value to be extracted from the pool.
In practical terms, the attack appears to have used temporary borrowed funds to distort the price or valuation CoreVault relied on, then redeemed against that altered state. The result, according to CertiK, was a significantly oversized payout relative to the position being redeemed.
No further response from the protocol was included in the materials tied to the incident, and the transaction record remains the clearest public reference point for the exploit itself. For users, the key detail is that the loss flowed through the InsurancePool rather than being described as a broader market event.
