Key Highlights
- Approximately 97 million CORE tokens staked through b14g were withdrawn without authorization at 09:29 UTC on October 31 and transferred to attacker-controlled addresses.
- b14g paused the affected staking contracts after detecting the incident to prevent further unauthorized activity.
- Around 68 million CORE remained on the Core network, while exchange partners froze approximately 9 million CORE linked to the attacker.
Bitcoin staking platform b14g reported that approximately 97 million CORE tokens staked through its platform were withdrawn without authorization at 09:29 UTC and transferred to attacker-controlled addresses. The project said it immediately paused the affected contracts upon discovery.
In a detailed X post on Saturday, the platform said it was working with the Core team, security partners, and exchanges to investigate the incident, trace the funds, and coordinate freezing and recovery efforts. Based on its tracing so far, approximately 68 million CORE remains on the Core network, while exchange partners had frozen about 9 million CORE linked to the attacker.
The affected assets are CORE tokens staked through b14g. Bitcoin staked through the platform remained time-locked on the Bitcoin network and was not impacted, according to the project. b14g said its immediate priorities were to protect users and recover the affected funds.
The project identified two attacker-controlled addresses: 0xc556ed208285406d71705927f92d4f4eaea579f1 and 0x27758c30f8e424fbd8ca605bf31e9496c26ce92c. The project said it will release a detailed post-mortem covering the technical cause, the impact, and next steps for affected users. Further updates will follow as information is verified.
Incident response and current status
b14g said the unauthorized withdrawals originated from its staking contracts. It paused the contracts linked to the incident to prevent further unauthorized activity.
The platform is coordinating with the Core team and external security partners to trace the movement of the tokens and support recovery efforts.
Of the roughly 97 million CORE moved, about 68 million remained on the Core chain at the time of the update. Approximately 9 million CORE identified as linked to the attacker has been frozen by exchange partners. B14g did not specify how much of the remaining amount had left the network or whether any portion had been converted into other assets.
Bitcoin deposited through b14g was described as unaffected because those assets remain under time-lock on the Bitcoin blockchain.
Core DAO says network was unaffected by b14g incident
Core DAO, a decentralized autonomous organization and ecosystem supporting Core Chain, said it was aware of the exploit affecting b14g, a restaking and yield protocol on Core and Babylon, and was working with the b14g team.
The organization said the Core network remained secure. Its consensus, validators, and staking contracts operated normally throughout the incident. CORE staked directly with validators or through other protocols was unaffected.
Core DAO said it was supporting b14g and exchange partners in tracing the funds and coordinating freezes. It added that most of the withdrawn CORE remained on the Core network and that exchanges were freezing deposits linked to the attacker.
Large-scale theft incidents in the crypto industry
The b14g incident comes in the same week as a major security breach at crypto exchange Binance. On October 29, attackers transferred approximately $6.3 billion from Binance hot wallets across 10 blockchains, according to The Crypto Times’ coverage.
Blockchain analytics firm TRM Labs attributed the breach to TraderTraitor, a group linked to North Korea. According to TRM Labs, the attack involved EIP-7702 authorizations on Ethereum and the use of valid signatures across multiple chains.
Other major incidents include the December 2020 theft of 127,426 BTC from the LuBian mining pool, valued at about $3.5 billion at the time, and the February 2025 Bybit breach that resulted in the transfer of approximately 401,000 ETH, or $1.5 billion. The Bybit attack was also attributed by the FBI to TraderTraitor and involved manipulation of a multisignature approval interface.
The b14g incident is smaller in reported value than those breaches but adds to security concerns involving staking protocols and the management of digital assets. b14g has not yet disclosed the technical cause of the withdrawals or the full extent of user losses.
Also Read: NXTT Board Authorizes Potential Bitcoin Sales Following Binance Security Breach