Zero-token withdrawals let a hacker drain 97 million CORE from Bitcoin staking platform b14g
Bitcoin staking platform b14g suffered a $1.47 million exploit on Oct. 31, losing approximately 97 million CORE tokens to a hacker exploiting zero-token withdrawal requests.
The attacker drained 91 staking positions in a single transaction by submitting withdrawal requests for zero CORE, according to an investigation by blockchain analytics firm Bitquery. The staking platform confirmed the unauthorized withdrawals and said it had paused the affected contracts while coordinating with the Core team, security partners, and exchanges to recover the funds.
However, b14g clarified that the breach was limited to CORE deposits. Bitcoin staked through the protocol remains time-locked on the BTC blockchain and was not affected.
Exploit mechanism
Bitquery's investigation revealed that the attacker exploited a weakness in the interaction between b14g's withdrawal mechanism and Core's staking contracts. Under normal circumstances, b14g allows Bitcoin holders to pair their BTC with CORE deposits to earn enhanced staking rewards.
Core's staking contract contains an unusual provision that interprets a withdrawal request for zero tokens as an instruction to withdraw the entire staked balance. The attacker exploited this behavior by submitting 99 zero-value withdrawal requests against staking positions it had not funded.
The underlying contract logic had reportedly been in place for approximately 17 months.
Response and recovery
Bitquery said the exploit occurred at 09:29 UTC, with the stolen tokens transferred to an attacker-controlled wallet. The investigation found no evidence that the attacker needed a compromised administrator key or a newly deployed malicious contract.
Blockchain records showed that b14g did not pause the affected contracts until 10:35 UTC, approximately 66 minutes after the initial attack. During that interval, the attacker transferred 23 million CORE from the original wallet through several newly created addresses.
By the evening of Oct. 31, approximately 68 million CORE, representing 70% of the stolen tokens, had remained unmoved in three wallets. Separately, b14g reported that exchange partners had frozen approximately 9 million CORE linked to the attacker.
Core DAO maintained that the underlying blockchain had not been compromised, stressing that its consensus mechanism, validators, and staking contracts continued operating normally throughout the incident.
b14g has pledged to publish a detailed post-mortem explaining the technical cause of the exploit, the extent of user losses, and the next steps for affected depositors. The platform has not yet disclosed a compensation plan.
Related
