Bitcoin staking platform b14g suffered a security breach on October 31, losing approximately 97 million CORE tokens valued at $1.47 million. The attacker exploited a weakness in the platform's withdrawal system to drain 91 staking positions in a single transaction.
According to blockchain analytics firm Bitquery, the attacker submitted withdrawal requests for zero CORE tokens against staking positions it had not funded. Core's staking contract contained a provision that interpreted zero-value withdrawal requests as instructions to withdraw the entire staked balance, allowing the unauthorized requests to proceed.
Rather than rejecting these requests, b14g's contract accepted them and passed the instructions to Core's staking system, which released the tokens. The exploit occurred at 09:29 UTC, with stolen funds transferred to an attacker-controlled wallet.
Attack Timeline and Response
b14g did not pause the affected contracts until 10:35 UTC, approximately 66 minutes after the initial attack. During that interval, the attacker transferred 23 million CORE through several newly created addresses.
Blockchain records showed that some stolen funds moved through intermediary addresses connected to exchange infrastructure associated with Bybit, Gate.io, and MEXC. By the evening of October 31, approximately 68 million CORE—representing 70% of the stolen tokens—remained unmoved in three wallets, while exchange partners had frozen approximately 9 million CORE linked to the attacker.
Scope of the Breach
b14g clarified that the breach was limited to CORE deposits. Bitcoin staked through the protocol remains time-locked on the BTC blockchain and was not affected. The platform confirmed it had paused the affected contracts while coordinating with the Core team, security partners, and exchanges to recover the funds.
Bitquery's investigation found no evidence that the attacker used a compromised administrator key or deployed a malicious contract. The underlying contract logic had reportedly been in place for approximately 17 months, though Bitquery cautioned it had not reviewed b14g's source code and could not identify the precise programming error.
Core DAO stressed that the underlying blockchain had not been compromised and that its consensus mechanism, validators, and staking contracts continued operating normally. CORE staked directly with validators or through other protocols remained unaffected.
b14g has pledged to publish a detailed post-mortem explaining the technical cause of the exploit and the extent of user losses, but has not yet disclosed a compensation plan for affected depositors.
