Core has rewritten three account balances at the protocol level to claw back 68.15 million CORE taken in the b14g exploit, and the Bitcoin staking protocol is now offering whoever holds the rest a 10% bounty if the remaining funds come back by November 6. On-chain checks by AltcoinReporter on Tuesday show the recovered tokens are still sitting untouched in the recovery contract, with nothing else returned so far.
The recovery, which b14g detailed in its first recovery update on Monday, covers 68,146,177.22 CORE out of the roughly 97,045,563 CORE affected when the protocol was drained on October 31. That is about 70.2% of the stolen amount. We covered the original attack in our report on the $97 million CORE drain.
How the Fermi fork moved the funds
The mechanism is spelled out in the Core client itself. Release v1.0.27 of the core-chain node software, published on October 31, adds a network upgrade named Fermi. Its code lists three addresses, sets each balance to zero at the fork block and credits the combined total to a single recipient address. The commit describes it as a one-time, mainnet-only state adjustment that leaves total supply unchanged, and warns that any validator which failed to upgrade before the activation time would continue on a different chain state.
The fork time in the chain configuration is 04:00 UTC on November 2. b14g said the adjustment did not reverse any transactions and did not mint new CORE.
The first address on the list, 0x2775…ce92c, is the attacker wallet that held about 63.6 million CORE when we checked it on October 31. Queries to the public Core RPC on Tuesday returned a zero balance for it and for the two other listed addresses. The recipient, 0xb850…c064, is a smart contract holding exactly 68,146,177.22 CORE, the same figure b14g reported. Because b14g has named that same address as the destination for voluntary returns, the unchanged balance indicates that no additional CORE has been sent back since the fork.
The bounty offer and its deadline
Later on Monday, b14g sent an on-chain message on Ethereum addressed to the exploiter, which the monitoring account Defimon surfaced in full. The terms are simple. If the remaining funds are returned, the sender keeps 10% as a whitehat reward and sends 90% back. CORE goes to the Core recovery address, while ETH or USDT goes to a separate Ethereum address, 0x7B56…0Ee8.
The offer expires on November 6, 2026, at 23:59 UTC. b14g said it was open to discussing confidentiality and legal assurances and listed an email address, Blockscan Chat and an on-chain contact address as channels. The mention of ETH and USDT suggests part of the stolen value left Core before the fork, where a state change on one chain cannot reach it.
What is still missing
The arithmetic leaves a sizeable gap. Subtracting the recovered 68.15 million from 97.05 million leaves about 28.9 million CORE outside the fork. Exchanges froze roughly 9 million CORE in the first hours after the attack, according to figures reported at the time, which puts the amount with no recovery path yet at around 19.9 million CORE.
In dollar terms the numbers are smaller than the token counts suggest. CORE traded near $0.0123 on Tuesday, down about 9% over 24 hours, according to CoinGecko. At that price the recovered tokens are worth roughly $840,000 and the unrecovered remainder a little over $350,000. The larger cost for affected users may be the price slide itself, since their recovered CORE is worth far less than it was before the exploit.
The exchange-frozen tokens have not been released either. b14g said it is working with exchanges and law enforcement on those balances and is preparing a distribution plan for recovered funds. No tokens have been distributed yet and there is no claims process. The team warned users to ignore anyone offering recovery services and never to share private keys or seed phrases.
Why the fork matters beyond b14g
A coordinated balance rewrite gets money back to victims, but it also shows that Core’s validator set can agree to move funds out of specific accounts when it decides the case is strong enough. The code comments try to limit that power, stating that only single-owner accounts may ever be listed and that shared or custodial accounts must never be touched. That is a rule written by developers, not a protocol guarantee, and the next time someone asks for a similar fix the bar for agreeing will be set by this one.
For now the open questions are narrower: whether any of the remaining 28.9 million CORE comes back before Friday’s deadline, and how quickly exchanges hand over the frozen 9 million. The recovery contract balance will show the first answer on-chain.
FAQ
How much CORE has b14g recovered?
b14g said 68,146,177.22 CORE, about 70.2% of the roughly 97 million CORE affected, was recovered through Core’s Fermi hard fork on November 2.
Can affected users claim their CORE now?
No. b14g said nothing has been distributed, there is no claims process yet, and users should ignore anyone offering to recover funds for them.
What is the deadline for the bounty?
b14g’s offer of a 10% whitehat reward on returned funds expires on November 6, 2026, at 23:59 UTC.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
