# b14g: about 97M CORE drained from its Core staking contracts; contracts paused · pwn.watch > On Oct 31 2026 at 09:29 UTC about 97M CORE staked through b14g, a Bitcoin dual-staking and yield protocol on the Core chain, was withdrawn without authorization and sent to attacker-controlled addresses, b14g said. It paused the affected contracts, says about 68M CORE remains on Core and exchange partners have frozen about 9M CORE linked to the attacker, and says BTC staked through b14g stays time-locked on Bitcoin and was not affected. Bitquery's on-chain analysis found one fresh wallet sent withdrawal requests for 0 CORE against 91 b14g staking orders it had never funded; Core's staking code treats 0 as the whole stake, so every order paid out in full (97.05M CORE, about $1.47M at the time). The pause came 66 minutes after the drain. Core DAO says the Core network itself was not compromised and CORE staked directly with validators or through other protocols is unaffected. b14g promises a post-mortem and next steps for affected users. Users have nothing to patch: don't restake through b14g until it publishes the post-mortem, and ignore unofficial refund offers. Page: https://pwn.watch/i/b14g-core-staking-zero-withdrawal-drain-oct-2026 · generated 2026-11-01T07:01:44.208Z ## Status - Severity: medium · status: live · patch: partial - Product: b14g CORE staking contracts (Core chain) - Started: 2026-10-31 - Affected: CORE staked through b14g staking contracts ## Follow this incident - RSS (one item per update): https://pwn.watch/i/b14g-core-staking-zero-withdrawal-drain-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/b14g-core-staking-zero-withdrawal-drain-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/b14g-core-staking-zero-withdrawal-drain-oct-2026.json - This file: https://pwn.watch/i/b14g-core-staking-zero-withdrawal-drain-oct-2026/llms.txt ## Updates (newest first) - 2026-10-31T17:24Z: Core DAO says the Core network is secure and CORE staked directly with validators or through other protocols is unaffected, and that it is helping trace and freeze the funds. (https://x.com/Coredao_Org/status/2116582149101121618) - 2026-10-31T16:38Z: b14g confirms about 97M CORE was withdrawn without authorization, names two attacker addresses, says about 68M CORE remains on Core and about 9M is frozen by exchanges, and says staked BTC was not affected. (https://x.com/b14g_network/status/2116570456245596580) - 2026-10-31T10:35Z: b14g's contracts are paused 66 minutes after the drain, by which time about 23.4M CORE has moved on through new addresses. (https://bitquery.io/investigations/b14g-hack) - 2026-10-31T09:29Z: A wallet funded half an hour earlier sends b14g withdrawal requests for 0 CORE against 91 staking orders it never funded; each order pays out in full, 97.05M CORE in total. (https://bitquery.io/investigations/b14g-hack) ## Fix brief # Security brief: b14g: about 97M CORE drained from its Core staking contracts; contracts paused Source: https://pwn.watch/i/b14g-core-staking-zero-withdrawal-drain-oct-2026 · status: live · severity: medium · updated Nov 1, 2026, 04:32 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is On Oct 31 2026 at 09:29 UTC about 97M CORE staked through b14g, a Bitcoin dual-staking and yield protocol on the Core chain, was withdrawn without authorization and sent to attacker-controlled addresses, b14g said. It paused the affected contracts, says about 68M CORE remains on Core and exchange partners have frozen about 9M CORE linked to the attacker, and says BTC staked through b14g stays time-locked on Bitcoin and was not affected. Bitquery's on-chain analysis found one fresh wallet sent withdrawal requests for 0 CORE against 91 b14g staking orders it had never funded; Core's staking code treats 0 as the whole stake, so every order paid out in full (97.05M CORE, about $1.47M at the time). The pause came 66 minutes after the drain. Core DAO says the Core network itself was not compromised and CORE staked directly with validators or through other protocols is unaffected. b14g promises a post-mortem and next steps for affected users. Users have nothing to patch: don't restake through b14g until it publishes the post-mortem, and ignore unofficial refund offers. Severity detail: About 97M CORE (about $1.47M) drained from 91 b14g staking orders; contracts paused, about 9M CORE frozen by exchanges, staked BTC unaffected - Product: b14g CORE staking contracts (Core chain) ## Affected versions - CORE staked through b14g staking contracts ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Latest updates - Oct 31, 2026: A wallet funded half an hour earlier sends b14g withdrawal requests for 0 CORE against 91 staking orders it never funded; each order pays out in full, 97.05M CORE in total. - Oct 31, 2026: b14g's contracts are paused 66 minutes after the drain, by which time about 23.4M CORE has moved on through new addresses. - Oct 31, 2026: b14g confirms about 97M CORE was withdrawn without authorization, names two attacker addresses, says about 68M CORE remains on Core and about 9M is frozen by exchanges, and says staked BTC was not affected. - Oct 31, 2026: Core DAO says the Core network is secure and CORE staked directly with validators or through other protocols is unaffected, and that it is helping trace and freeze the funds. ## Advisories - [b14g Security Update](https://x.com/b14g_network/status/2116570456245596580) (b14g) ## Write-ups & news - [b14g Hack: 97M CORE Taken by Asking to Withdraw Zero](https://bitquery.io/investigations/b14g-hack) - [Core DAO Says b14g Exploit Did Not Compromise Core Network](https://www.tokenpost.com/news/technology/45685) - [b14g Probes 97M CORE Withdrawal as Exchanges Freeze 9M Tokens](https://www.cryptotimes.io/2026/11/01/b14g-probes-97m-core-withdrawal-as-exchanges-freeze-9m-tokens/) ## Caveats The dollar value is Bitquery's figure at the time of the drain. b14g has not yet published its post-mortem or said how affected users will be made whole. --- Machine-readable: https://pwn.watch/i/b14g-core-staking-zero-withdrawal-drain-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.