Hacker drains 97M CORE, about $1.5M, from b14g on Core

An attacker withdrew about 97 million CORE without authorization from b14g, a staking platform built on the Core network, at 5:29 AM ET (09:29 UTC) on Oct. 31. Bitquery puts the value at about $1.47 million. The b14g team said it paused the affected contracts and that BTC staked through b14g remains time-locked on Bitcoin and was not affected.

Details

According to Bitquery's investigation, a single transaction submitted 99 withdrawal requests for zero CORE against 91 staking positions the attacker never funded. Core's staking code reads a zero amount as "withdraw everything available," and b14g's contract did not validate that input, so the positions paid out in full: 97.05 million CORE. The $1.47 million figure uses a pre-attack price of $0.0151 per token.

b14g says about 68 million CORE remains on Core and exchange partners have frozen about 9 million CORE linked to the attacker. Bitquery traced part of the funds to wallets at Bybit, MEXC and Gate.io; by the evening of Oct. 31 roughly 70% had not moved from the attacker's addresses. The contracts were paused about an hour after the theft, near 6:35 AM ET. The team promises a detailed post-mortem and a plan for affected users; no timeline or compensation has been announced.

Core's own statement stresses that the network, validators and staking contracts operated normally and that CORE staked directly with validators or through other protocols is unaffected. It describes b14g as a restaking and yield protocol on Core and Babylon and says it is helping to trace and freeze funds.

What it means for the market

This is a protocol-level exploit, not a network-level one, and the loss is small in a month that also saw the Binance hack. It does show the risk at the seams between contracts: the flaw sat in logic that passes user input to a base contract and, per Bitquery, stayed in the code for about 17 months.

For bitcoin holders the key point is that BTC staked via b14g was not touched, according to the team; the losses are in CORE. Live prices are in the daily brief.

Full timeline — in our explainer.