b14g: about 97M CORE drained from its Core staking contracts; contracts paused
b14g CORE staking contracts (Core chain)
On Oct 31 2026 at 09:29 UTC about 97M CORE staked through b14g, a Bitcoin dual-staking and yield protocol on the Core chain, was withdrawn without authorization and sent to attacker-controlled addresses, b14g said. It paused the affected contracts, says about 68M CORE remains on Core and exchange partners have frozen about 9M CORE linked to the attacker, and says BTC staked through b14g stays time-locked on Bitcoin and was not affected. Bitquery's on-chain analysis found one fresh wallet sent withdrawal requests for 0 CORE against 91 b14g staking orders it had never funded; Core's staking code treats 0 as the whole stake, so every order paid out in full (97.05M CORE, about $1.47M at the time). The pause came 66 minutes after the drain. Core DAO says the Core network itself was not compromised and CORE staked directly with validators or through other protocols is unaffected. b14g promises a post-mortem and next steps for affected users. Users have nothing to patch: don't restake through b14g until it publishes the post-mortem, and ignore unofficial refund offers.
Why this severity: About 97M CORE (about $1.47M) drained from 91 b14g staking orders; contracts paused, about 9M CORE frozen by exchanges, staked BTC unaffected
- Started
- Oct 31, 2026
Affected
- CORE staked through b14g staking contracts
Fixed in
No fixed release yet
Timeline4
A wallet funded half an hour earlier sends b14g withdrawal requests for 0 CORE against 91 staking orders it never funded; each order pays out in full, 97.05M CORE in total.
b14g's contracts are paused 66 minutes after the drain, by which time about 23.4M CORE has moved on through new addresses.
b14g confirms about 97M CORE was withdrawn without authorization, names two attacker addresses, says about 68M CORE remains on Core and about 9M is frozen by exchanges, and says staked BTC was not affected.
Core DAO says the Core network is secure and CORE staked directly with validators or through other protocols is unaffected, and that it is helping trace and freeze the funds.
Advisories1
News & write-ups3
Posts2
b14g Security Update At 09:29 UTC today, approximately 97M CORE staked through b14g was withdrawn without authorization and transferred to attacker-controlled addresses. Upon discovery, we immediately paused the affected contracts. We are working closely with the Core team, security partners and exchanges to investigate the incident, trace the funds and coordinate freezing and recovery efforts. Based on tracing so far, approximately 68M CORE remains on Core. Exchange partners have frozen approximately 9M CORE linked to the attacker. The affected assets are CORE staked through b14g. BTC staked through b14g remains time-locked on Bitcoin and was not affected. Our immediate priority is protecting users and recovering the affected funds. Attacker addresses: 0xc556ed208285406d71705927f92d4f4eaea579f1 0x27758c30f8e424fbd8ca605bf31e9496c26ce92c We will publish a detailed post-mortem covering the technical cause and impact, along with next steps for affected users. Further updates will follow as information is verified.
We’re aware of the exploit affecting b14g, a restaking and yield protocol on Core and Babylon, and we’re working closely with their team. The Core network is secure. Core’s consensus, validators and staking contracts operated normally throughout, and CORE staked directly with validators or through other protocols is unaffected. We’re supporting b14g and exchange partners to trace and freeze the funds. Most of the stolen CORE remains on Core, and exchanges are freezing deposits linked to the attacker. We’ll share updates as we have them.
Notes & caveats
The dollar value is Bitquery's figure at the time of the drain. b14g has not yet published its post-mortem or said how affected users will be made whole.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
