Oh no, this world is fucking crazy. Someone borrowed $143.6 million just to siphon $110,000 from a tiny pool 😂
An incident surfaced on-chain this morning: a small project called CoreVault on BNB Chain had an InsurancePool attached to it, meant to provide a safety net for depositors.
The attacker first took out a flash loan of roughly $143.6 million in WBNB. They used the funds to make a series of huge swaps in the pool, forcibly skewing the price. The contract used that exact spot price when processing redemptions, inflating the payout by nearly 33 times. The insurance pool coughed up 260.21 BNB in one go, worth around $180,000 at the time.
Then the attacker reversed those swaps, repaid the flash loan with interest, and wrapped it all up in a single transaction. After costs, they pocketed about 160.26 BNB—roughly $110,000, not counting gas.
The insurance pool lost even more, with nearly $180,000 flowing out. It was called insurance, but ended up as someone else's ATM. Pretty ironic.
The $143 million principal was in their hands for only a few seconds: borrow, dump, withdraw, repay. They barely had to spend any of their own money. Projects keep falling into this trap every so often, using prices that can be easily manipulated as their reference price. After reading this, I really feel for the people who deposited their money.
Newbies should do more research and trade less. If you're buying crypto, stick to $BTC
An incident surfaced on-chain this morning: a small project called CoreVault on BNB Chain had an InsurancePool attached to it, meant to provide a safety net for depositors.
The attacker first took out a flash loan of roughly $143.6 million in WBNB. They used the funds to make a series of huge swaps in the pool, forcibly skewing the price. The contract used that exact spot price when processing redemptions, inflating the payout by nearly 33 times. The insurance pool coughed up 260.21 BNB in one go, worth around $180,000 at the time.
Then the attacker reversed those swaps, repaid the flash loan with interest, and wrapped it all up in a single transaction. After costs, they pocketed about 160.26 BNB—roughly $110,000, not counting gas.
The insurance pool lost even more, with nearly $180,000 flowing out. It was called insurance, but ended up as someone else's ATM. Pretty ironic.
The $143 million principal was in their hands for only a few seconds: borrow, dump, withdraw, repay. They barely had to spend any of their own money. Projects keep falling into this trap every so often, using prices that can be easily manipulated as their reference price. After reading this, I really feel for the people who deposited their money.
Newbies should do more research and trade less. If you're buying crypto, stick to $BTC
