<h2 id="span-span-style-font-size-16px-how-did-zero-token-requests-trigger-the-1-5m-b14g-exploit-span-span">How Did Zero-Token Requests Trigger the $1.5M b14g Exploit?&nbsp;</h2>
The b14g exploit pulled about 97 million $CORE out of a Bitcoin staking protocol on Saturday, October 31, 2026.&nbsp;
The attacker used withdrawal requests that asked for zero tokens. At pre-attack prices the haul was worth roughly $1.5 million, so this was a $1.5 million <a href="https://www.coingabbar.com/en/crypto-hacks-october-2026-binance-theft-black-october-recap" rel="noopener noreferrer nofollow">crypto hack</a>, not a $97 million one.
<img alt="Official b14g Post on X" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/cpDYYpPqeLaahwK2aMyfBVOAI57NWqBi9IZlUuWE.png" width="300" height="778" title="Official b14g Post on X">
Source:<a href="https://x.com/b14g_network/status/2116570456245596580" style="background-color: rgb(255, 255, 255)" rel="noopener noreferrer nofollow">b14g Post on X</a>
The b14g staking protocol, a Bitcoin dual-staking layer built on Core, said the unauthorized staking withdrawals happened at 09:29 UTC. The team paused the affected contracts. A post-mortem has been promised, with no date.
Per the project's own security update, <a href="https://www.coingabbar.com/en/tag/bitcoin" rel="noopener noreferrer nofollow">BTC staked</a> through b14g stays time-locked on Bitcoin and was not affected.
<h2 id="span-span-style-font-size-16px-how-did-a-zero-token-withdrawal-bug-empty-91-staking-positions-span-span">How Did a Zero Token Withdrawal Bug Empty 91 Staking Positions?</h2>
An on-chain investigation traced the loss to one transaction at 09:29:51 UTC. That transaction carried 99 withdrawal requests, each asking for zero $CORE.&nbsp;
They targeted 91 delegated positions the attacker had never funded, and together they released 97.05 million $CORE.
The catch behind the b14g exploit sits in how Core's staking code reads the number zero. It treats a zero amount as an instruction to withdraw the full balance. The b14g contracts let those requests through, so each empty-looking request emptied a real position.
<h3 id="span-span-style-font-size-16px-was-it-a-core-staking-vulnerability-or-a-b14g-design-gap-span-span">Was It a $Core Staking Vulnerability or a b14g Design Gap?</h3>
The investigation found no sign of a stolen admin key or a freshly deployed malicious contract. That points to a weakness in how b14g handled withdrawals, rather than a break into the chain itself.
Whether it is a Core staking vulnerability or a protocol contract vulnerability on the b14g side is still open, because b14g has not published its own technical explanation.
<h2 id="span-span-style-font-size-16px-where-is-the-stolen-core-now-frozen-funds-and-open-questions-span-span">Where Is the Stolen $CORE Now? Frozen Funds and Open Questions</h2>
b14g identified two addresses controlled by the attacker. About 68 million $CORE still sits on the&nbsp;network, and exchange partners have frozen roughly 9 million CORE tied to the attacker.
Movements between the flagged wallets are visible on the&nbsp;<a href="https://scan.coredao.org/" rel="noopener noreferrer nofollow">Core block explorer</a>, which records every transfer on the chain.
That leaves roughly 20 million $CORE from the b14g exploit without a public update. b14g has not said where the rest sits or how much users may get back.
<h2 id="span-span-style-font-size-16px-did-the-core-dao-hack-reach-the-network-or-staked-bitcoin-span-span">Did the Core DAO Hack Reach the Network or Staked Bitcoin?</h2>
Many headlines frame the event as a Core DAO hack, but the network itself was not breached. In its&nbsp;<a href="https://x.com/Coredao_Org/status/2116582149101121618" rel="noopener noreferrer nofollow">public statement</a>, Core DAO said consensus, validators and staking contracts ran normally throughout.
<img alt="Core Dao Post on X" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/9HDH8WXWTxlHbptqwgtnoFYcuEUEaWlvQuRnZAIX.png" width="300" height="409" title="Core Dao Post on X">
Source:<a href="https://x.com/Coredao_Org/status/2116582149101121618" style="background-color: rgb(255, 255, 255)" rel="noopener noreferrer nofollow">Core Dao Post on X</a>
CORE staked directly with validators, or through other protocols, was not affected.
The split matters for Bitcoin staking security. Because BTC stayed time-locked on Bitcoin while only the token side was drained, the b14g exploit stayed contained to one layer of the product.
<h2 id="span-span-style-font-size-16px-expert-take-what-could-change-the-b14g-story-next-span-span">Expert Take: What Could Change the b14g Story Next?</h2>
The data suggests this was an input validation gap, not a cryptographic break. One transaction, 99 requests, and 91 positions point to a simple check failing at scale.
The main uncertainty remains the b14g exploit post-mortem. Until it arrives, the exact failure point between b14g's withdrawal logic and Core's zero-means-all rule is based on outside analysis, not a team confirmation.
It is also unclear whether withdrawal routes stay open while the contracts are paused. For a DeFi exploit of this size, the pace of the post-mortem and the freeze efforts will likely shape confidence in the protocol more than the dollar figure.
<h2 id="span-span-style-font-size-16px-conclusion-span-span">Conclusion</h2>
The b14g exploit remains an open case and a notable <a href="https://www.coingabbar.com/en/binance-security-incident-coverage-jump-withdrawals-reopen-date" rel="noopener noreferrer nofollow">crypto security breach</a> for Bitcoin staking. The 97 million $CORE outflow, the 91 emptied positions, the paused contracts, and the secure Core network are now on record.&nbsp;
The full technical cause, the location of the remaining tokens, and any user compensation are still to come. Further Core DAO news and related updates appear in the&nbsp;<a href="https://www.coingabbar.com/en/crypto-news-english" rel="noopener noreferrer nofollow">latest crypto news</a> coverage.&nbsp;
Disclaimer:This article is for information only and is not financial or investment advice. Crypto assets are volatile and carry a risk of loss, including from security incidents. Verify details through official project channels.

Was a Single Staking Code Flaw Behind the $1.5M b14g Exploit?

Table of Contents

Coingabbar

Other articles published on Nov 2, 2026

Join our free newsletter for daily crypto updates!