97.05 Million CORE Withdrawn from b14g Staking in 99 Zero-Amount Requests
Key Facts
A total of 97.05 million CORE was withdrawn from staked assets through b14g after the attacker submitted 99 requests, each asking to withdraw zero CORE, according to Bitquery’s analysis of on-chain records. The analysis said Core’s staking code treated the zero value as a request to withdraw a validator’s entire balance, causing each staking command to pay out its full balance. The incident involved CORE staked through b14g, a dual Bitcoin and CORE staking layer on the Core network. Core DAO said the network, its consensus, validators and staking contracts continued to operate normally. It added that CORE staked directly with validators or through other protocols was unaffected.
Bitquery’s analysis distinguishes what could be observed on-chain from identifying where the flaw was located within the platform; it said it had not reviewed b14g’s code and therefore could not identify the responsible line of code. The analysis linked the withdrawals to the zero-amount requests, which the staking contract treated as requests to withdraw the full balance. According to Bitquery, 70% of the withdrawn CORE had not moved as of the evening of October 31. That makes movement of the remaining balances a direct indicator of where the funds went after the operation. The percentage remained tied to the amount withdrawn as Bitquery observed it at that time.
Bitquery observed some funds reaching addresses it classified as deposit addresses or service wallets associated with Bybit, Gate.io and MEXC. The report said one service route received 11.0 million CORE through four deposit addresses, then forwarded the amount to MEXC on the morning of October 31. But subsequent transfers to trading services do not prove that all funds reaching those services came from the withdrawn assets. The report therefore limits its account to the observed movement of funds, without attributing all balances that passed through those addresses to the withdrawal.
b14g said BTC staked through its platform remained time-locked on the Bitcoin network and was unaffected by the incident. Bitquery’s analysis did not verify the Bitcoin side, while the platform promised to publish a full report on the incident. According to the timeline cited by Bitquery, b14g published its security update at 16:38 UTC on October 31. Core DAO published a statement at 17:24 UTC saying the network was secure. The full report promised by b14g remains the next milestone in following the incident.