Zero-Withdrawal Bug Drained 97M CORE From b14g Staking Protocol

A single transaction at 09:29:51 UTC on Saturday, October 31, pulled roughly 97 million $CORE tokens — about $1.5 million at pre-attack prices — out of b14g, a Bitcoin dual-staking protocol built on Core. The trigger was deceptively simple: 99 withdrawal requests, each asking for zero tokens, together emptied 91 delegated positions the attacker had never funded.

The flaw sits in how Core's staking code interprets the number zero. It treats a zero-amount request as an instruction to withdraw the full balance. b14g's contracts let those requests through, so each empty-looking request drained a real position. On-chain investigators found no stolen admin key and no freshly deployed malicious contract, pointing to an input validation gap in b14g's withdrawal handling rather than a cryptographic break or a breach of the chain itself.

What happened to the stolen tokens?

• b14g identified two addresses controlled by the attacker.
• About 68 million $CORE still sits on the network.
• Exchange partners have frozen roughly 9 million $CORE tied to the attacker.
• That leaves roughly 20 million $CORE unaccounted for, with no public update on its location.

Movements between the flagged wallets remain visible on the Core block explorer, which records every transfer on the chain. b14g has not said how much, if anything, users may recover.

Was Core itself hacked?

No. Many headlines framed the incident as a Core DAO hack, but the network was not breached. In its public statement, Core DAO said consensus, validators and staking contracts ran normally throughout, and CORE staked directly with validators or through other protocols was unaffected.

The split matters for Bitcoin staking security. BTC staked through b14g stays time-locked on Bitcoin and was not touched. Because only the token side was drained, the exploit stayed contained to one layer of the product rather than cascading into the underlying Bitcoin positions.

The b14g team paused the affected contracts at the time of the incident, which it disclosed at 09:29 UTC. It has promised a post-mortem with no date attached, and it is unclear whether withdrawal routes stay open while contracts remain paused.

What does this change for Bitcoin staking?

For now, attribution remains unresolved. Whether the vulnerability lives in Core's staking code — where zero means "withdraw everything" — or in b14g's failure to validate the input is still an open question, because b14g has not published its own technical explanation. Until it does, the exact failure point rests on outside analysis, not team confirmation.

What is on record: 97.05 million $CORE out, 91 emptied positions, paused contracts, and a secure Core network. The full technical cause, the location of the remaining 20 million tokens, and any user compensation are still to come. For a DeFi exploit of this size, the pace of the post-mortem and the freeze effort will shape confidence in the protocol more than the dollar figure. Until b14g delivers that post-mortem, depositors in Bitcoin staking products have one more reason to ask exactly how a protocol handles the number zero.