A Zero-Value Withdrawal Drained 97 Million CORE From Bitcoin Staking Platform b14g

A single zero-value withdrawal request was enough to trigger a full payout from dozens of staking positions, draining roughly 97 million CORE from the Bitcoin staking platform b14g.

The attack did not break the Core blockchain or its validator system. Instead, an on-chain investigation from Bitquery found that the failure sat in the way b14g passed withdrawal instructions into Core’s staking contracts.

In Core’s staking logic, a withdrawal amount of zero means withdraw everything. The attacker sent zero-value requests across 91 b14g staking orders in one transaction.

Each order paid out in full.

Bitquery followed the drain transaction, its payouts and the later movement of the tokens through Core’s public node, tracing the first attacker wallet, the second wallet that retained most of the balance, and transfers toward service and exchange-related addresses. The researchers also checked wallet balances later that day, used address labels to identify likely destinations, compared the token’s price before and after the drain, and separated conclusions visible on-chain from recovery claims that only centralized exchanges could confirm.

Their analysis distinguishes direct on-chain findings from claims that cannot be verified from the ledger, including the amount exchanges reportedly froze. It also treats the Bitcoin-side safety claim as a statement from b14g rather than an independently audited conclusion.

The researchers valued the stolen CORE using the market price shortly before the drain. They also measured the token’s later decline and tracked where the largest balances remained.

That method gives the report a clear cutoff: wallet balances were read on the evening of October 31. Transfers after that point fall outside its findings.

At that cutoff, the second attacker wallet still held most of the unmoved balance. Other transfers had reached service wallets and exchange-related addresses identified through transaction behavior and Bitquery labels.

The report did not claim that every labeled deposit was available for trading. It separated visible token movement from the exchanges’ internal freeze status.

That is an important limit on the evidence. The chain can show where tokens went, but it cannot show whether a centralized platform has blocked the account that received them.

One transaction emptied 91 positions.

Bitquery traced the drain to the morning of October 31. The attacker-controlled wallet requested zero CORE from each position, but the downstream staking contracts interpreted those zeros as commands to release the complete balances.

The result was approximately 97 million CORE leaving the affected positions. At the price immediately before the drain, Bitquery valued the loss at about $1.47 million.

That distinction matters because an early social-media estimate reportedly confused the token count with a dollar figure.

b14g confirmed that approximately 97 million CORE had been withdrawn without authorization and said it paused the affected contracts after discovering the incident.

b14g Security Update

At 09:29 UTC today, approximately 97M CORE staked through b14g was withdrawn without authorization and transferred to attacker-controlled addresses.

Upon discovery, we immediately paused the affected contracts. We are working closely with the Core team,…

— b14g (@b14g_network) October 31, 2026

Core itself kept working normally.

The exploit’s location is crucial. Bitquery said the Core staking contracts did what they were asked to do.

The dangerous translation happened before those instructions reached Core, inside the b14g flow that connected its staking orders to the network.

Core DAO said the network’s consensus, validators and staking contracts operated normally throughout the incident. It also said CORE staked directly with validators, or through other applications, was not affected.

We’re aware of the exploit affecting b14g, a restaking and yield protocol on Core and Babylon, and we’re working closely with their team.

The Core network is secure. Core’s consensus, validators and staking contracts operated normally throughout, and CORE staked directly with… https://t.co/fcQbbrxpVI

— Core DAO 🔶 (@Coredao_Org) October 31, 2026

A report from CryptoSlate similarly described the incident as a zero-token withdrawal failure in the Bitcoin-linked staking platform rather than a compromise of Core’s base network.

The report highlighted the mismatch between b14g’s withdrawal flow and Core’s interpretation of a zero amount. It also noted that the exploit affected CORE associated with b14g positions, while directly staked CORE and the network’s consensus continued operating.

That distinction narrows the technical failure without minimizing the loss. Users can face a full drain through an application-layer integration even when the underlying chain performs exactly as specified.

CryptoSlate also focused on the response from b14g and Core DAO. Both teams said they were working together after the affected contracts were paused.

The report treated recovery as an active process rather than a completed result. Exchange freezes and remaining attacker balances still required further confirmation.

Most of the stolen CORE had not moved.

By the evening of October 31, Bitquery found that about 70% of the stolen CORE remained in attacker-controlled wallets. The rest had moved toward exchange and service addresses, including wallets associated through labels or transaction patterns with Bybit, Gate.io and MEXC.

b14g said exchanges had frozen roughly 9 million CORE. Bitquery cautioned that exchange freezes happen inside centralized platforms’ own books, so that figure cannot be confirmed from the blockchain alone.

The investigation also noted that the BTC staked through b14g remained locked on Bitcoin, according to the platform. The exploit withdrew CORE; it did not move the time-locked Bitcoin positions.

Bitquery said it did not independently audit the Bitcoin side of that claim.

A dangerous meaning for zero.

The incident is a stark example of what can happen when two systems assign different practical meanings to the same input. A zero can look harmless at one layer and become an instruction to empty an account at the next.

That makes integration testing as important as contract testing. A protocol can interact with a base chain that is functioning correctly and still expose users to catastrophic loss if its own translation layer sends a valid but unintended command.

For b14g users, the next important evidence will be the promised post-mortem: exactly how the withdrawal amount was validated, why 91 positions accepted the same dangerous instruction, and what changes will prevent a zero-value request from becoming a full exit again.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.