Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyMonthly

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

B14g

Security incidents tagged B14g. Newest first.

1 B14g incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½LessMore
Incidents
1
Live
1
Patched
0
Days without an incident
0
Longest quiet run: 1 day (Nov 1–Nov 1)
All tags →
  • Mediumb14g: about 97M CORE drained from its Core staking contracts; contracts paused

    b14g CORE staking contracts (Core chain) Partly patched

    On Oct 31 2026 at 09:29 UTC about 97M CORE staked through b14g, a Bitcoin dual-staking and yield protocol on the Core chain, was withdrawn without authorization and sent to attacker-controlled addresses, b14g said. It paused the affected contracts, says about 68M CORE remains on Core and exchange partners have frozen about 9M CORE linked to the attacker, and says BTC staked through b14g stays time-locked on Bitcoin and was not affected. Bitquery's on-chain analysis found one fresh wallet sent withdrawal requests for 0 CORE against 91 b14g staking orders it had never funded; Core's staking code treats 0 as the whole stake, so every order paid out in full (97.05M CORE, about $1.47M at the time). The pause came 66 minutes after the drain. Core DAO says the Core network itself was not compromised and CORE staked directly with validators or through other protocols is unaffected. b14g promises a post-mortem and next steps for affected users. Users have nothing to patch: don't restake through b14g until it publishes the post-mortem, and ignore unofficial refund offers.

    Open incident →

Posts 2

  • b14g: about 97M CORE drained from its Core staking contracts; contracts paused
    Core DAO
    @Coredao_Org

    We’re aware of the exploit affecting b14g, a restaking and yield protocol on Core and Babylon, and we’re working closely with their team. The Core network is secure. Core’s consensus, validators and staking contracts operated normally throughout, and CORE staked directly with validators or through other protocols is unaffected. We’re supporting b14g and exchange partners to trace and freeze the funds. Most of the stolen CORE remains on Core, and exchanges are freezing deposits linked to the attacker. We’ll share updates as we have them.

  • b14g: about 97M CORE drained from its Core staking contracts; contracts paused
    b14g
    @b14g_network

    b14g Security Update At 09:29 UTC today, approximately 97M CORE staked through b14g was withdrawn without authorization and transferred to attacker-controlled addresses. Upon discovery, we immediately paused the affected contracts. We are working closely with the Core team, security partners and exchanges to investigate the incident, trace the funds and coordinate freezing and recovery efforts. Based on tracing so far, approximately 68M CORE remains on Core. Exchange partners have frozen approximately 9M CORE linked to the attacker. The affected assets are CORE staked through b14g. BTC staked through b14g remains time-locked on Bitcoin and was not affected. Our immediate priority is protecting users and recovering the affected funds. Attacker addresses: 0xc556ed208285406d71705927f92d4f4eaea579f1 0x27758c30f8e424fbd8ca605bf31e9496c26ce92c We will publish a detailed post-mortem covering the technical cause and impact, along with next steps for affected users. Further updates will follow as information is verified.

Sponsored

Buy sponsor slot