Bitcoin staking protocol b14g said on Saturday that about 97 million CORE staked through its contracts was withdrawn without authorization and moved to attacker-controlled addresses. At Saturday’s prices that is about $1.35 million worth of tokens, and b14g says the bitcoin its users staked was not touched. The case tests a claim Bitcoin staking products lean on: that a failure in the smart-contract layer should not reach the BTC itself.
What b14g disclosed
In its security update, b14g said the withdrawal happened at 09:29 UTC on October 31 and that it “immediately paused the affected contracts” once it found the problem. Its public notice came about seven hours later.
The team gave three numbers. About 97 million CORE left its contracts. Based on tracing so far, about 68 million CORE “remains on Core.” Exchange partners have frozen about 9 million CORE linked to the attacker. b14g did not name the exchanges.
“The affected assets are CORE staked through b14g. BTC staked through b14g remains time-locked on Bitcoin and was not affected,” the team said. b14g published two attacker addresses and promised a post-mortem “covering the technical cause and impact, along with next steps for affected users.” It has not said whether users will be reimbursed.
The Defiant, which also covered the incident, put the 97 million CORE at about $1.36 million at midday prices in the summary of its report.
Core DAO says the network was not compromised
CORE is the native token of the Core blockchain. Core DAO said it was working closely with the team behind b14g, which it described as a restaking and yield protocol on Core and Babylon, and drew a line between the chain and the protocol.
“The Core network is secure. Core’s consensus, validators and staking contracts operated normally throughout, and CORE staked directly with validators or through other protocols is unaffected,” Core DAO said. It added that “most of the stolen CORE remains on Core, and exchanges are freezing deposits linked to the attacker.”
Where the stolen CORE sits
The two addresses b14g named are easy to follow on-chain. The first, ending in 79f1, made a single contract call at 09:29 UTC, the minute b14g gave for the withdrawal. Over the next hour it sent 11 transfers of between 1 million and 2.9 million CORE, about 23.4 million in total, to other addresses. It then sent about 73.6 million CORE in one transfer to the second address, ending in e92c. It now holds almost nothing.
The second address moved 15 million CORE out in four transfers, then received 4,999,999 CORE back from one of the receiving addresses. At about 19:45 UTC on Saturday, a direct query to Core’s public RPC showed that address holding about 63.6 million CORE. Together, the first address’s outflows come to about 97 million CORE, in line with b14g’s figure.
All 15 addresses that received CORE from the two attacker wallets had been emptied by then, our RPC query shows. The explorer does not show which, if any, of them belong to exchanges. b14g has not said how its 68 million figure breaks down, or whether it includes the 63.6 million CORE in the e92c wallet.
Small in dollars, larger relative to CORE
CORE traded at about $0.0139 at 19:45 UTC on Saturday, down about 8.5% over 24 hours, with a market value of about $20.9 million, according to CoinGecko. At that price, the full 97 million CORE is worth about $1.35 million and the 63.6 million in the attacker’s main wallet about $0.88 million. At the time of the withdrawal, when CoinGecko’s price history shows CORE near $0.0151, the 97 million tokens were worth about $1.47 million. Those are our estimates and move with the token price.
The dollar loss is small next to incidents such as August’s $8.5 million Term Finance governance exploit. In token terms it is larger. CoinGecko lists about 1.5 billion CORE in circulation, so 97 million CORE is roughly 6.5% of the circulating supply. How much of it exchanges can block matters for the token as much as for b14g’s users.
It is also the second security problem in the Core ecosystem in about two months. In late August, Core DAO said a small number of validators had accrued block rewards above the protocol’s intended issuance. A v1.0.26 hard fork on September 3 “burned 150M+ CORE of excess issuance,” Core DAO said at the time. That incident sat in the chain’s reward accounting. This time, Core DAO says its consensus, validators and staking contracts operated normally.
Why the BTC leg held
By b14g’s account, the bitcoin its users staked stays time-locked on Bitcoin itself, while the CORE side sits in the contracts that were drained, so the attacker reached the CORE, not the BTC. The post-mortem should show how cleanly the two sides were kept apart. Institutions are being pitched similar products, as with Stacks opening Bitcoin staking to institutions, and the split between the BTC and the yield token is now part of the risk picture.
What to watch next
The post-mortem is the main open item; until then the root cause is unknown. Other open questions are which exchanges froze the 9 million CORE, whether the 63.6 million CORE wallet stays put or gets frozen, and what b14g offers users whose CORE was taken.
FAQ
How much was stolen from b14g? b14g said about 97 million CORE staked through its contracts was withdrawn without authorization. By our estimate, that is about $1.35 million at CoinGecko’s CORE price at 19:45 UTC on October 31.
Was staked bitcoin affected? No, according to b14g. It said BTC staked through the protocol remains time-locked on Bitcoin and was not affected.
Was the Core blockchain hacked? Core DAO said the network is secure and that CORE staked directly with validators or through other protocols is unaffected.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
