A BNB Chain vault's insurance pool got drained this week. It was insuring against exactly this.
An attacker flash-borrowed about 207,000 WBNB (roughly $143.6M) from Lista DAO's Moolah and dumped most of it into PancakeSwap's WBNB/USDT pair. CoreVault's oracle uses a three-source median, but when its TWAP windows aren't filled it falls back to PancakeSwap spot. The redemption came out about 33x too big.
About 260 BNB (~$180K) left the InsurancePool. After unwinding the loan, the attacker kept roughly 160 BNB, about $112K. No postmortem or recovery plan yet.
Three price sources, and a fallback to the only one you can rent for a single transaction.