Was a Single Staking Code Flaw Behind the $1.5M b14g Exploit?
How Did Zero-Token Requests Trigger the $1.5M b14g Exploit?
The b14g exploit pulled about 97 million $CORE out of a Bitcoin staking protocol on Saturday, October 31, 2026.
The attacker used withdrawal requests that asked for zero tokens. At pre-attack prices the haul was worth roughly $1.5 million, so this was a $1.5 million crypto hack, not a $97 million one.
Source: b14g Post on X
The b14g staking protocol, a Bitcoin dual-staking layer built on Core, said the unauthorized staking withdrawals happened at 09:29 UTC. The team paused the affected contracts. A post-mortem has been promised, with no date.
Per the project's own security update, BTC staked through b14g stays time-locked on Bitcoin and was not affected.
How Did a Zero Token Withdrawal Bug Empty 91 Staking Positions?
An on-chain investigation traced the loss to one transaction at 09:29:51 UTC. That transaction carried 99 withdrawal requests, each asking for zero $CORE.
They targeted 91 delegated positions the attacker had never funded, and together they released 97.05 million $CORE.
The catch behind the b14g exploit sits in how Core's staking code reads the number zero. It treats a zero amount as an instruction to withdraw the full balance. The b14g contracts let those requests through, so each empty-looking request emptied a real position.
Was It a $Core Staking Vulnerability or a b14g Design Gap?
The investigation found no sign of a stolen admin key or a freshly deployed malicious contract. That points to a weakness in how b14g handled withdrawals, rather than a break into the chain itself.
Whether it is a Core staking vulnerability or a protocol contract vulnerability on the b14g side is still open, because b14g has not published its own technical explanation.
Where Is the Stolen $CORE Now? Frozen Funds and Open Questions
b14g identified two addresses controlled by the attacker. About 68 million $CORE still sits on the network, and exchange partners have frozen roughly 9 million CORE tied to the attacker.
Movements between the flagged wallets are visible on the Core block explorer, which records every transfer on the chain.
That leaves roughly 20 million $CORE from the b14g exploit without a public update. b14g has not said where the rest sits or how much users may get back.
Did the Core DAO Hack Reach the Network or Staked Bitcoin?
Many headlines frame the event as a Core DAO hack, but the network itself was not breached. In its public statement, Core DAO said consensus, validators and staking contracts ran normally throughout.
Source: Core Dao Post on X
CORE staked directly with validators, or through other protocols, was not affected.
The split matters for Bitcoin staking security. Because BTC stayed time-locked on Bitcoin while only the token side was drained, the b14g exploit stayed contained to one layer of the product.
Expert Take: What Could Change the b14g Story Next?
The data suggests this was an input validation gap, not a cryptographic break. One transaction, 99 requests, and 91 positions point to a simple check failing at scale.
The main uncertainty remains the b14g exploit post-mortem. Until it arrives, the exact failure point between b14g's withdrawal logic and Core's zero-means-all rule is based on outside analysis, not a team confirmation.
It is also unclear whether withdrawal routes stay open while the contracts are paused. For a DeFi exploit of this size, the pace of the post-mortem and the freeze efforts will likely shape confidence in the protocol more than the dollar figure.
Conclusion
The b14g exploit remains an open case and a notable crypto security breach for Bitcoin staking. The 97 million $CORE outflow, the 91 emptied positions, the paused contracts, and the secure Core network are now on record.
The full technical cause, the location of the remaining tokens, and any user compensation are still to come. Further Core DAO news and related updates appear in the latest crypto news coverage.
Disclaimer: This article is for information only and is not financial or investment advice. Crypto assets are volatile and carry a risk of loss, including from security incidents. Verify details through official project channels.
