CryptoSlate
b14g lost approximately 97 million CORE, valued at $1.47 million, after an attacker used zero-value withdrawal requests to drain 91 staking positions in one transaction on Oct. 31. The platform paused the affected contracts and is coordinating with the Core team, security partners and exchanges to recover funds.
Why it matters
Bitquery found that the attack exploited a behavior in Core's staking contract: a withdrawal request for zero tokens could trigger withdrawal of the entire staked balance. The attacker submitted 99 such requests against positions it had not funded, and b14g's contract passed them through. The logic had reportedly been in place for about 17 months. Bitquery said it had not reviewed b14g's source code and could not identify the precise programming error.
The incident was limited to CORE deposits. Bitcoin staked through b14g remained time-locked on the Bitcoin blockchain and was not affected. Core DAO said its blockchain, consensus mechanism, validators and staking contracts continued operating normally.
Market impact
About 68 million CORE remained unmoved in three wallets by the evening of Oct. 31, while b14g said exchange partners had frozen about 9 million CORE. Blockchain records show the platform paused the affected contracts about 66 minutes after the exploit; during that interval, 23 million CORE moved from the initial wallet through new addresses. Bitquery traced some funds through addresses connected to exchange infrastructure, while cautioning that some wallets also handled other customers' assets.
b14g has pledged a post-mortem covering the technical cause, user losses and next steps, but has not disclosed a compensation plan. The recovery effort and the promised explanation are key developments for affected depositors.
Frequently asked questions
-
How did the attacker drain b14g's CORE staking positions?
The attacker submitted zero-value withdrawal requests. Core's staking contract treated a zero-token request as an instruction to withdraw the entire staked balance, and b14g's contract passed the requests through.
-
How much CORE was taken and how many positions were affected?
Approximately 97 million CORE, valued at $1.47 million, was drained from 91 staking positions in one transaction.
-
Were Bitcoin deposits or Core's blockchain affected?
The breach was limited to CORE deposits. Bitcoin staked through b14g remained time-locked on Bitcoin, and Core DAO said its blockchain and staking operations continued normally.
-
How much of the stolen CORE was frozen or still unmoved?
As of the evening of Oct. 31, about 68 million CORE remained unmoved in three wallets. b14g said exchange partners had frozen about 9 million CORE.
-
Has b14g announced compensation for affected depositors?
No compensation plan has been disclosed. b14g has pledged to publish a post-mortem on the exploit, user losses and next steps.
WuBlockchain
CoinDesk
TheBlock
Crypto Rank News