Bitcoin staking platform b14g suffered a 97 million CORE token theft on Oct. 31 after an attacker exploited a flaw in Core’s staking contract logic that interprets zero-token withdrawal requests as full balance withdrawals.
The attacker submitted 99 zero-value withdrawal requests against staking positions on b14g, draining tokens valued at $1.47 million according to blockchain analytics firm Bitquery. The exploit emptied 91 staking positions in a single transaction at 09:29 UTC.
b14g paused affected contracts 66 minutes after the initial attack. By the evening of Oct. 31, approximately 68 million CORE tokens remained unmoved in three wallets controlled by the attacker, representing 70% of the stolen amount. A separate 23 million CORE was transferred through newly created addresses during the interval between the exploit and the pause.
How the exploit worked
b14g allows Bitcoin holders to pair BTC deposits with CORE tokens to earn enhanced staking rewards. Users create staking positions that hold CORE and delegate it to validators on the Core blockchain. The underlying staking contract contained a provision that interprets zero-token withdrawal requests as instructions to withdraw entire staked balances.
The attacker exploited this by submitting withdrawal requests against staking positions it had not funded. b14g’s contract accepted the unauthorized requests and passed them to Core’s staking system, which released the tokens. Bitcoin staked through the protocol remains time-locked on the BTC blockchain and was not affected by the breach.
Response and recovery efforts
b14g coordinated with Core team, security partners, and cryptocurrency exchanges to recover funds. Bybit, Gate.io, and MEXC froze 9 million CORE in total, according to available reports.
Core DAO stated that the underlying blockchain, consensus mechanism, validators, and staking contracts continued operating normally throughout the incident. The exploit targeted b14g’s implementation layer, not Core’s core infrastructure.
b14g pledged to publish a post-mortem analysis but has not disclosed a compensation plan for affected users. Bitquery stated it had not reviewed b14g’s underlying source code and could not identify the precise programming error responsible for the vulnerability.
The staking contract logic that enabled the exploit had reportedly existed for 17 months before the attack occurred.
