Bitcoin staking platform b14g suffered a $1.47 million exploit on Oct. 31, losing approximately 97 million CORE tokens.

The attacker drained 91 staking positions in a single transaction by submitting withdrawal requests for zero CORE, according to an investigation by blockchain analytics firm Bitquery.

The staking platform confirmed the unauthorized withdrawals and said it had paused the affected contracts while coordinating with the Core team, security partners, and exchanges to recover the funds.

However, b14g clarified that the breach was limited to CORE deposits. Bitcoin staked through the protocol remains time-locked on the BTC blockchain and was not affected.

How hackers exploited b14g’s withdrawal mechanism

Bitquery’s investigation revealed that the attacker exploited a weakness in the interaction between b14g’s withdrawal mechanism and Core’s staking contracts.

Under normal circumstances, b14g allows Bitcoin holders to pair their BTC with CORE deposits to earn enhanced staking rewards. The protocol manages these arrangements through staking positions that hold CORE and delegate it to validators.

However, Core’s staking contract contains an unusual provision that interprets a withdrawal request for zero tokens as an instruction to withdraw the entire staked balance.

The attacker exploited this behavior by submitting 99 zero-value withdrawal requests against staking positions it had not funded.

Rather than rejecting the unauthorized requests, b14g’s contract accepted them and passed the instructions to Core’s staking system, which released approximately 97 million tokens.

Bitquery said the exploit occurred at 09:29 UTC, with the stolen tokens transferred to an attacker-controlled wallet.

The investigation found no evidence that the attacker needed a compromised administrator key or a newly deployed malicious contract. Instead, the underlying contract logic had reportedly been in place for approximately 17 months.

However, Bitquery cautioned that it had not reviewed b14g’s underlying source code and could not identify the precise programming error that allowed the unauthorized withdrawals.

Meanwhile, blockchain records showed that b14g did not pause the affected contracts until 10:35 UTC, approximately 66 minutes after the initial attack.

During that interval, the attacker transferred 23 million CORE from the original wallet through several newly created addresses.

The timeline does not establish when b14g discovered the breach, although the platform said it paused the contracts immediately after identifying the incident.

Further tracing revealed that some stolen funds moved through intermediary addresses connected to exchange infrastructure associated with Bybit, Gate.io, and MEXC.

Bitquery also identified a service that supplied the attacker’s initial transaction fees, then received about 11 million CORE from the stolen funds and forwarded them to an MEXC deposit address.

However, the analytics firm cautioned that some intermediary wallets also handled other customers’ assets, making it difficult to attribute every subsequent transfer directly to the attacker.

By the evening of Oct. 31, approximately 68 million CORE, representing 70% of the stolen tokens, had remained unmoved in three wallets.

Separately, b14g reported that exchange partners had frozen approximately 9 million CORE linked to the attacker.

In its response, Core DAO maintained that the underlying blockchain had not been compromised, stressing that its consensus mechanism, validators, and staking contracts continued operating normally throughout the incident.

It also said CORE staked directly with validators or through other protocols remained unaffected.

b14g has pledged to publish a detailed post-mortem explaining the technical cause of the exploit, the extent of user losses, and the next steps for affected depositors. The platform has not yet disclosed a compensation plan.