b14g hack explained: how 97M CORE was stolen

At 5:29 AM ET on Oct. 31, a single transaction pulled 97.05 million CORE out of b14g, a staking platform on the Core network. At the pre-attack price of $0.0151 per token that is about $1.47 million, according to Bitquery. No keys were stolen and no code was swapped: the attacker asked to withdraw zero tokens, and the platform paid out everything. BTC staked through b14g was not affected, the team says.

What we know now

• 97,045,563 CORE (~$1.47M at the pre-attack price) was taken from 91 user staking positions on b14g (Bitquery).
• b14g's contracts have been paused since 6:35 AM ET on Oct. 31. The team promises a detailed post-mortem and a plan for affected users. No timeline, compensation or recovery bounty has been announced.
• b14g says about 68M CORE remains on Core and exchange partners have frozen about 9M CORE linked to the attacker. Bitquery confirms that 68.15M CORE (70%) had not moved by the evening of Oct. 31; exchange freezes cannot be verified on-chain.
• Core says its network, validators and staking contracts operated normally, and CORE staked directly with validators or through other protocols is unaffected.
• The attacker has not been identified. As of our latest check, neither b14g nor Core had issued new statements since Oct. 31.

How it happened

b14g lets users stake CORE and BTC together for a higher yield. The bitcoin stays time-locked on the Bitcoin chain, while the CORE sits in b14g "orders" — individual contracts that keep the CORE delegated to a Core validator.

Per Bitquery's analysis, the attacker sent one transaction with 99 withdrawal requests for zero CORE against 91 orders they had never funded. Core's staking code treats a request for zero as "withdraw everything the staker has." b14g's contract neither rejected that input nor checked who owned the order, so each order paid out its full balance to the attacker's wallet.

Bitquery notes that b14g's code is not public, so it could not point to the faulty line; the conclusion comes from transaction records. There is no sign of a stolen key or a rushed upgrade: the contract logic running at the time had been unchanged for 17 months. The attacker's wallet was new and had never interacted with b14g before. Forty-eight of the 91 orders accounted for 90% of the loot; the largest gave up 2.04M CORE.

Timeline

• Oct. 31, 5:00 AM ET. A fresh attacker wallet (A) receives 615.62 CORE for fees from a service Bitquery calls "Service Y."
• Oct. 31, 5:29 AM ET. One transaction with 99 zero-amount withdrawal requests empties 91 b14g orders: 97.05M CORE lands in wallet A.
• Oct. 31, 5:37⁠–⁠6:10 AM ET. Part of the funds leaves wallet A through 15 new addresses, heading to a Bybit hot wallet and to Services X and Y.
• Oct. 31, 6:15⁠–⁠7:15 AM ET. Service Y forwards 11.16M CORE to a MEXC deposit address.
• Oct. 31, 6:35 AM ET. b14g pauses its contracts, 66 minutes after the drain.
• Oct. 31, 6:36 AM ET. Wallet A moves the remaining 73.65M CORE to a second attacker wallet (B).
• Oct. 31, 12:38 PM ET. b14g posts a security update: about 97M CORE withdrawn without authorization, about 68M still on Core, about 9M frozen by exchanges, BTC unaffected. It names two attacker addresses.
• Oct. 31, 1:24 PM ET. Core says the network is secure and that it is helping b14g and exchanges trace and freeze the funds.
• Oct. 31, 3:43 PM ET. In Bitquery's last reading, wallet B holds 63.65M CORE and two new wallets hold 4.5M, all unmoved. CORE trades at $0.0139, down 8.5% over 24 hours.
• Oct. 31, 5:00 PM ET. Bitquery publishes its investigation with the fund flow and addresses.

Where the money went

Attacker addresses named by b14g:

• wallet A: 0xc556ed208285406d71705927f92d4f4eaea579f1
• wallet B: 0x27758c30f8e424fbd8ca605bf31e9496c26ce92c

Where the 97.05M CORE stood at 3:43 PM ET on Oct. 31, per Bitquery:

In total, 68.15M CORE (70%) had not moved and 28.9M (30%) reached exchanges or services. Service X passed 6.08M on to Bybit and Gate.io deposit addresses and still held 9.34M that evening. Services X and Y also handle other customers' coins, so their onward transfers are mixed with other funds. Bitquery's analysis shows no mixers or bridges.

What the team and exchanges did

b14g paused the affected contracts and says it is working with Core, security partners and exchanges to trace the funds and coordinate freezes. Beyond the overall figure of about 9M CORE, it has not said how much was frozen or where. Core says it is supporting b14g and exchange partners, and that exchanges are freezing deposits linked to the attacker. No bounty or negotiations with the attacker have been announced.

What it means for holders

The losses are limited to CORE staked through b14g. According to the team, bitcoin staked via the platform remains time-locked on Bitcoin and was not touched. Core says staking CORE directly with validators or through other protocols works normally. How b14g will treat the drained orders should become clear after the promised post-mortem. If most of the funds that are still sitting in the attacker's wallets or frozen at exchanges can be recovered, the final loss could end up well below 97M CORE, but there is no guarantee of that yet.

Early details are in our news story; live bitcoin prices are in the daily brief.

This is not investment advice.

This story is developing: we are following events and adding new information. Last updated Nov 1, 3:10 PM ET.