b14g Recovers 70% of Stolen CORE After Zero-Amount Withdrawal Attack

Bitcoin dual-staking protocol b14g said it had recovered 68.15 million CORE tokens, representing about 70% of the 97.05 million CORE stolen in an attack on October 31, 2026. The recovery came after the Core network implemented a hard fork on November 2, while the platform has also announced plans to repay users who lost their staked tokens.

The platform detailed how the attack occured in a November 5 post on X. According to the firm, it started at around 09:29 UTC when an attacker exploited a flaw that allowed withdrawals from 91 staking orders by requesting to withdraw zero CORE. 

https://t.co/HJS2J8KzOJ

— b14g (@b14g_network) November 6, 2026

The attacker made 99 withdrawal requests in a single transaction, draining the affected orders and sending the tokens to wallets under their control.

How the attacker stole 97 million CORE

B14g said the attack happened because of a change in how Core’s staking contract handles withdrawal requests. 

Before September 9, 2025, anyone who tried to withdraw zero CORE would have their transaction rejected. However, after Core updated its staking system, a zero-amount request could release all the tokens held by a delegator.

 b14g’s contracts did not account for this change. Its withdrawal system checked whether the amount requested was greater than the user’s staked balance. Since zero CORE was not greater than the balance, the request passed the check and was sent to Core’s staking contract.

This allowed the attacker to withdraw the entire balance of each affected order. The attacker repeated the process across 91 orders in one transaction.

b14g explained that its contracts had not been changed for 17 months and that no private keys were stolen during the attack. The hacker also did not break into any administrative account or introduce new code into the platform’s contracts. Instead, the attacker used the normal withdrawal function with an amount that the platform had failed to block.

Core hard fork helps recover stolen funds

Following the attack, b14g paused the affected contracts and began coordinating with the Core team, security partners and cryptocurrency exchanges to trace the stolen tokens.

The largest recovery came on November 2, when a Core network hard fork helped return 68.15 million CORE that remained in attacker-controlled wallets. This represents approximately 70.2% of the total stolen amount.

Other recovery efforts have focused on tokens transferred to exchange-linked addresses. According to b14g, ChangeNOW reportedly froze 9.5 million CORE across three orders after the attacker moved some funds through its platform. However, ChangeNOW has not directly confirmed the freeze to b14g.

Bybit also froze 2.5 million CORE that passed through Swapter. Meanwhile, 13.4 million CORE moved through HitBTC, with some sent to Bybit, Gate, and an unidentified wallet.

About 9.58 million CORE moved before freezes could be placed. These funds can no longer be frozen at their original deposit addresses, meaning recovery efforts will now depend on exchange account records and further tracing.

How b14g plans to repay affected users

b14g has confirmed that it has verified the balances associated with all affected staking orders and will repay users in two parts.

First, the recovered 68.15 million CORE will be returned to the affected orders within five to seven days. Each user will receive approximately 70.2% of their original balance. For example, someone who had 1,000 CORE staked will receive about 702 CORE.

The remaining amount will be repaid using 50% of b14g’s future revenue from Core staking. Users will be able to claim their share every week, and any additional CORE recovered from exchange freezes will also be added to the repayment.

Platform plans changes to prevent another attack

b14g said it would introduce checks to reject zero and invalid withdrawal amounts instead of depending on Core’s staking contract to reject them. It also plans to review its integration following changes to Core’s staking system.

The platform will introduce automated alerts to detect unusual withdrawals and improve its emergency response system to enable the team to pause affected contracts within minutes.

Meanwhile, Bitcoin deposited through b14g was not affected. The BTC remains locked on the Bitcoin blockchain until its scheduled release dates, meaning the attack only affected CORE tokens.

Also Read: b14g Probes 97M CORE Withdrawal as Exchanges Freeze 9M Tokens