Web3 Daily Exploits — 4 Nov 2026: CoreVault ~$112K Oracle Flash-Loan on BNB

The 4 Nov America/Panama window records one first-reported protocol incident used for scoring. CoreVault (also referenced as BNIX / OSK) on BNB Chain suffered a flash-loan oracle manipulation that inflated principal redemptions by up to approximately 33×, depleting its InsurancePool of roughly 260 BNB before the attacker reversed the trade and repaid the loan, netting about 160.26 BNB (~$112K at contemporaneous prices). DefimonAlerts estimated the gross pool loss near $181K. Separately, Mercado Bitcoin provided an UPDATE on its 2 November multi-chain signing incident, stating affected assets at approximately $36.3M with $12.9M blocked or frozen and outlining a gradual platform reopening plan; customers remain covered with no reported losses. The prior Binance ~$6.3B signing compromise remains an UPDATE. Combined live loss on this card is ~$112K for the newly scored CoreVault item.

CoreVault / BNIX / OSK — BNB Chain — ~$112K — flash-loan oracle manipulation

What happened: On or around 3–4 November 2026 UTC, an attacker flash-borrowed a large amount of WBNB (reports cite ~207K WBNB or ~$143.6M notional via Lista DAO’s Moolah) and dumped a substantial portion into a thin WBNB/USDT PancakeSwap pair, inflating the spot price used by CoreVault’s oracle. The protocol’s redeemPrincipal() function computed bnbAmount from redeemableUsd × wbnbPerUsd, and OracleLib.getAccountingPrices degraded to the manipulated spot when TWAP or average windows were unfilled. This allowed redemptions up to ~33× normal size. Treasury.payoutBnb and InsurancePool.withdrawReserve paid out ~260 BNB from the insurance pool. The attacker then swapped back, repaid the flash loan, and netted ~160 BNB. No protocol pause or official postmortem was public at cutoff.

Protocol / chain / asset: CoreVault farming vault (impl referenced as 0x11d9df62) and associated InsurancePool on BNB Chain (BSC). Asset: BNB / WBNB. Token referenced as $OSK or BNIX in monitoring posts.

Loss: CertiKAlert and Onchain Lens put the attacker’s net at 160.26 BNB (~$112.2K). DefimonAlerts reported a ~$181K gross depletion of the insurance pool ( ~259 BNB). Live scored figure used here is ~$112K (net). Most or all of the extracted BNB remained with the attacker at reporting time.

Attack type: Flash-loan funded oracle / spot-price manipulation exploiting an accounting path that falls back to a manipulable PancakeSwap spot price. Classic thin-liquidity oracle abuse against a redemption or insurance payout function.

Explorer URLs: Attack transaction: https://bscscan.com/tx/0x072a10a579e2a8afa26a681205a2aaaa38f74bcb9d1064b12bd9e9ebe2c598b3. Initiating wallet (Onchain Lens): https://bscscan.com/address/0xD3565b191b28B49Cc517189B984dacDB1FF05304. Funds destination: https://bscscan.com/address/0x028491B55D0E18aA81aB3324688E42f91BbadaCC. BscScan: https://bscscan.com/.

Status: Confirmed by CertiKAlert, DefimonAlerts and Onchain Lens monitoring. No official project statement, pause announcement or recovery plan located at cutoff. Treat as confirmed drain of the reported BNB amount from the InsurancePool. Flag any subsequent protocol communication as material update.

Sources: DefimonAlerts: https://x.com/DefimonAlerts/status/2117840075291513155; CertiKAlert: https://x.com/CertiKAlert/status/2117807437357183374; Onchain Lens thread; CryptoBriefing coverage.

Also noted

• Mercado Bitcoin multi-chain signing drain (UPDATE, not re-scored): Incident first reported 2 November. On 3 November the exchange stated affected assets approximately $36.3M at current prices, with $12.9M blocked or frozen (up from prior ~$11M), and that it is preparing a gradual restoration of services once each function passes security checks. Customers remain fully covered with balances recorded and no data leak reported. Independent estimates previously ranged $38–49M. Not a new loss figure for scoring. Sources: Mercado Bitcoin statements on X; CoinMarketCap Academy; CryptoTimes.
• Binance hot-wallet signing-access compromise (UPDATE, not re-scored): The ~$6.3 billion multi-chain drain from 29 October remains on prior briefs. Ongoing notes include further fund movements, freezes and Binance replenishment statements. No material new loss figures used for scoring today. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-30-oct-2026-binance-63b-eip7702-polymarket-debugbear/.
• Prior items (not re-scored): PremiaLabs, Troves, b14g, BTCPay Server older-version sweeps, Name.com DNS/StepDrainer and earlier incidents remain as previously briefed. No material new loss figures used for scoring.
• Monitored accounts: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi and rekt.news. No additional first-report protocol or smart-contract drains with fresh scored loss figures beyond the CoreVault item.

Sources and references

• DefimonAlerts CoreVault: https://x.com/DefimonAlerts/status/2117840075291513155
• CertiKAlert CoreVault: https://x.com/CertiKAlert/status/2117807437357183374
• Onchain Lens: https://x.com/OnchainLens/status/2117808252352344346
• CryptoBriefing: https://cryptobriefing.com/corevault-flash-loan-oracle-attack-bnb/
• 3 Nov brief for Mercado Bitcoin: https://www.rektradar.xyz/web3-daily-exploits-03-nov-2026-mercado-46m-signing-drain/
• 30 Oct brief for Binance: https://www.rektradar.xyz/web3-daily-exploits-30-oct-2026-binance-63b-eip7702-polymarket-debugbear/
• Monitored accounts checked: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, rekt.news. No additional first-report protocol exploits with fresh scored loss figures in the last 24 hours.

Editor’s note: the scored live loss on this card is ~$112K. The newly reported item is the CoreVault BNB Chain flash-loan oracle manipulation against the InsurancePool. Mercado Bitcoin is an UPDATE with refined affected-asset and freeze figures. Binance remains an UPDATE. No how-to or exploit reproduction steps. Stay tuned or stay rekt.