CoreVault / InsurancePool: Following the BNB Trail to Tornado.cash

ChainBounty Investigation Analysis | 9 November 2026

A BNB Chain wallet gained 160.257771766360162994 BNB across the seed block, then forwarded a reported 162.169168 BNB to a newly observed intermediary. The following morning, that intermediary made ten deposits totaling 162.1 BNB into an address labeled as the Tornado.cash Proxy.

This investigation summary draws exclusively on SentinelTX’s CoreVault / InsurancePool — BNB fund-flow investigation, case CASE-AE964964, dated November 8, 2026. The report establishes a transaction trail while leaving the exploit’s full accounting, the operators’ identities and the destination after mixing unresolved. All times below are UTC.

The seed transaction and the balance change

At 21:50:20 on November 3, 2026, address 0xd3565b191b28b49cc517189b984dacdb1ff05304 submitted a successful contract-creation transaction in block 131507810. The report identifies this address as the signer and deployer.

The transaction created 0xc28cfeee046e1421e9dbfb2cf689074bf9f387e2 and produced 93 event logs. Those logs were not decoded in the report, and its evidence does not include the internal call tree.

Two native-balance readings anchor the financial result:

• Block 131507809: 1.911397681184347886 BNB.
• Block 131507810: 162.169169447544510880 BNB.
• Net change: +160.257771766360162994 BNB, after the signer’s gas cost.

This block-level net increase does not establish the reserve outflow, borrowed principal, or repayment and fee.

Seed transaction: 0x072a10a579e2a8afa26a681205a2aaaa38f74bcb9d1064b12bd9e9ebe2c598b3 Source: SentinelTX CASE-AE964964, Executive Summary and Conclusion, pages 4 and 12–13.

Why the forwarded amount is larger

At 21:51:56 on November 3, the signer transferred a reported 162.169168 BNB to 0x028491b55d0e18aa81ab3324688e42f91bbadacc. The intermediary was first seen November 3, without an identifying label.

The forwarded amount includes funds already present before the seed block. The signer began with 1.911397681184347886 BNB, then experienced the documented net increase. Calling the entire onward transfer “profit” would therefore overstate what the balance comparison establishes.

Figure 1. The signer's native balance increased by 160.257771766360162994 BNB across blocks 131507809–131507810, net of its own gas. It later sent 162.169168 BNB to the intermediary at 2026-11-03T21:51:56Z. These are different measurements, not additive quantities or incident-loss totals. The PDF records a pre-seed balance of 1.911397681184347886 BNB, which was already present before the gain.

Color key: Slate identifies the seed-block balance change; sage identifies the later transfer. The panel titles carry the distinction in B&W. Color does not imply ownership, risk or proof.

Address/role key: Signer = 0xd3565b191b28b49cc517189b984dacdb1ff05304. Intermediary = 0x028491b55d0e18aa81ab3324688e42f91bbadacc. These are transaction roles, not real-world identities.

Source: Editorial summary of SentinelTX, CASE-AE964964, Executive Summary, p. 4; Transaction Chronology, p. 6. Quantities retain the PDF narrative’s precision. Seed timestamp: 2026-11-03T21:50:20Z.

Forwarding transaction: 0xd08a5eda1116941a92907acd3efdbdc6b71272d5e9daa9e0da367196b4701535

Ten deposits, one clear tracing boundary

Between 04:54:04 and 04:57:20 on November 4, the intermediary sent 162.1 BNB to 0x0d5550d52428e7e3175bfc9550207e4ad3859b17. SentinelTX records the Sentinel Protocol label “Tornado.cash, Mixer, Tornado.cash: Proxy” for that contract.

The ten deposits followed fixed denominations:

• 1 × 100 BNB
• 6 × 10 BNB
• 2 × 1 BNB
• 1 × 0.1 BNB

These denominations match mixer pools. The split alone does not establish an intent to evade reporting thresholds.

At 04:57:48, the intermediary also sent a reported 0.068098 BNB to 0x02dcd01d534477b5e76628a7284e7fa71c7a7ed7. The report’s rounded reconciliation lists 162.168098 BNB forwarded across eleven transactions, leaving a 0.00107 BNB difference from the rounded receipt, which it describes as consistent with gas.

Figure 2. Ten BNB deposits entered the Tornado.cash Proxy on 4 November 2026 between 04:54:04 and 04:57:20 UTC: 1 × 100 BNB, 6 × 10 BNB, 2 × 1 BNB and 1 × 0.1 BNB, totaling 162.1 BNB. Bars show the group totals of 100, 60, 2 and 0.1 BNB on a linear, zero-baseline 0–100 BNB scale. The 0.1 BNB bar is below one pixel wide at 720px; its direct label preserves its value. This is a deposit total, not incident loss. The PDF says the denominations are dictated by the mixer and do not by themselves establish structuring intent.

Color key: Slate bars identify deposited BNB. Direct count, denomination and amount labels carry the meaning in B&W; color is not a risk scale.

Address/role key: Depositor/intermediary = 0x028491b55d0e18aa81ab3324688e42f91bbadacc. Proxy = 0x0d5550d52428e7e3175bfc9550207e4ad3859b17, labeled “Tornado.cash, Mixer, Tornado.cash: Proxy” in the PDF, with Sentinel Protocol given as the label source.

Source: Editorial summary of SentinelTX, CASE-AE964964, Executive Summary, pp. 4–5; Transaction Chronology, pp. 6–7; Transaction Typology, p. 9. The group totals are the stated count × denomination; they reproduce the PDF's 162.1 BNB total without adding onward hops.

The first 100 BNB deposit also records a same-transaction hop from the Proxy to 0x1e34a77868e19a6647b1f2f47b51ed72dede95dd. This is part of the deposit route, not proof of a later withdrawal to an operator.

First deposit transaction: 0xda5964dcc7f5f93a77c77b2a06be89b308cf234c63970c8183b874fb10dd1cff

The deterministic trail ends at the mixer. No withdrawal is linked to these deposits by the report. Timing or a matching denomination alone would not establish that link.

The examined evidence identified zero exchange deposit addresses. This does not establish that the funds never reached an exchange: unlabelled counterparties and activity beyond the mixer remain unresolved.

The attack narrative remains partly unverified

Public-reporting snippets summarized in the PDF describe a flash-loan-funded price manipulation involving CoreVault redemption and an InsurancePool payout. They report approximately $143.6 million of WBNB borrowed through Lista DAO Moolah, a redemption inflated about 33 times, and a reserve payout.

These remain leads. The gross reserve outflow and full execution mechanism have not been established by transaction-level evidence in this record. The dollar-denominated loan estimate is not a verified native WBNB principal.

The PDF contains WBNB and USDT transfer rows associated with the seed hash, but those rows do not supply a decoded execution trace identifying the lender, manipulated price source, protocol contracts or repayment.

The report’s assessment is that the pattern is consistent with flash-loan-funded DEX spot-price oracle manipulation. The balance increase rounds to the public “160.26 BNB” figure without resolving gross-loss accounting.

Separate activity and earlier leads

A separate token-disposal sequence began at 22:07:56 on November 3, when the signer received a reported 3,414.5285767965115 OSK from its earlier-deployed contract 0xd9c2e4f19746b4617ad658152adaa306c47ef86b.

At 22:07:57, a transaction through the address labeled PancakeSwap Router v2 recorded:

• 3,073.0757191168605 OSK to 0x5986772dc1970d1d9e030867f1156e36f9b07ce4.
• 170.72642883982556 OSK to 0xfe6085dd822acc23352fb6b1fe52509253492422.
• 170.72642883982556 OSK to the zero address, 0x0000000000000000000000000000000000000000.
• A reported receipt of 0.06190122454689079 WBNB from 0x3fc593d15c34d2f91ca3b4f2097dddaf3c4de86c.

A subsequent WBNB unwrap call is recorded, but its amount was not decoded. BNB, WBNB and OSK remain separate quantities throughout the accounting.

On November 2, 8 BNB passed from the signer through its auxiliary contract to 0x302f5084ba0e4a2d4de5e6bc5dd5247028f5d674. The shared recipient 0x02dcd01d534477b5e76628a7284e7fa71c7a7ed7 received a reported 0.066555 BNB from the signer as well as the intermediary’s 0.068098 BNB. Its listed history reaches back to September 21 and includes 25 contract-creation records among 29 control transactions; some creation attempts failed.

These relationships are follow-up leads, not evidence of common ownership, identity or earlier attacks. Similar-looking addresses flagged as suspected poisoning had no value-bearing rows in the retained tables and were excluded as connections.

Reading the scope correctly

The report contains 304 movement rows across 30 addresses. Its gross totals include 804,618.047953 WBNB, 27,582,948.606662 USDT, 1,007.303821 BNB, 13,658.114307 OSK and 7.844058 FIST. Value can be counted again at each hop, and broader mixer activity can involve other users. These totals are neither incident losses nor amounts proven to belong to this case.

The stated case window is November 3 through November 8, 16:10 UTC. The actual queries extended from October 4 to November 8; retained movement timestamps span November 1–8. The first trace reached three of five requested hops, three address reads were incomplete, and high-volume addresses limited expansion. “No outbound” in the traced set does not establish inactivity outside it.

Figure 3. The PDF confirms BNB movement from the signer through the intermediary to the mixer Proxy. Its traced path ends at the mixer, beyond which there is no deterministic on-chain link. The flash-loan principal and repayment, gross reserve outflow, protocol contract addresses, and the identity or control of people behind the addresses remain unestablished. The report recommends decoding the seed receipt and obtaining its call trace, with any later mixer link requiring independent corroboration. It identifies zero exchange deposits in the examined evidence; later exchange use remains unknown.

Color and line key: Slate marks structural headings and role boxes only. Solid, equal-width arrows show the observed direction of BNB movement; they do not encode amount or common control. The dashed line beneath the mixer marks the limit of the traced path, not an inferred continuation. Direct labels preserve these distinctions in B&W.

Address/role key: Signer = 0xd3565b191b28b49cc517189b984dacdb1ff05304. Intermediary = 0x028491b55d0e18aa81ab3324688e42f91bbadacc. Mixer Proxy = 0x0d5550d52428e7e3175bfc9550207e4ad3859b17. No real-world identity or control finding is made.

Source: Editorial summary of SentinelTX, CASE-AE964964, Recommendations and Conclusion, pp. 11–13. The report also states that the first trace reached 3 of 5 requested hops and that three addresses were not fully read.

What investigators should pursue next

A full seed trace and decoded receipt are needed to establish the principal, reserve outflow, repayment, fee and gross credit. The report recommends preserving all ten deposit hashes without attributing withdrawals absent independent corroboration.

Follow-up priorities include the shared recipient’s deployment history, earlier 8 BNB route, OSK recipients and unlabelled counterparties. The signer’s reported Ethereum and Optimism activity falls outside this investigation’s scope.

The report also recommends compliance watch-list circulation and reporting through the affected parties’ national cybercrime and financial-intelligence channels. With no identified exchange deposit, it supplies no specific exchange account for a freeze or KYC request. Current sanctions treatment requires separate checking; the PDF did not assess OFAC status. A return-bounty message is discussed as a low-cost option with limited prospects, not as an action already taken.

The documented BNB balance increase was followed by rapid forwarding and ten mixer deposits. Recovery prospects are assessed as poor on the available on-chain trail. Establishing the exact loss and any recoverable destination requires evidence beyond that boundary.