b14g dual-staking protocol on Core: about 97M staked CORE withdrawn without authorization to attacker addresses

Summary

b14g, a Bitcoin dual-staking and restaking protocol on Core, reported that about 97 million CORE staked through b14g was withdrawn without authorization at 09:29 UTC on 2026-10-31 and sent to attacker-controlled addresses. b14g paused the affected contracts and has not yet disclosed the technical cause. It says it will publish a post-mortem.

Affected

• CORE staked through b14g's staking contracts on Core
• BTC staked through b14g remains time-locked on Bitcoin and was not affected (per b14g)
• CORE staked directly with Core validators or through other protocols was not affected, and the Core network itself was not compromised (per Core DAO)
• No fix available at time of publication: the affected contracts are paused

Impact

About 97M CORE was withdrawn, worth roughly $1.3M at the CORE market price when this advisory was written (0xCERT estimate; neither b14g nor Core DAO has stated a USD figure). b14g says about 68M CORE remains on Core and that exchange partners have frozen about 9M CORE linked to the attacker. Exploitation in the wild is confirmed. The root cause has not been disclosed.

Recommended actions

• b14g users: do not interact with b14g contracts until b14g confirms they are safe, and follow only b14g's official channels for recovery updates
• Exchanges and bridges: flag and freeze deposits from the attacker addresses listed in the indicators
• Beware of follow-on phishing that offers fake refunds or claims

Source & attribution

This 0xCERT advisory summarises b14g's security update (https://x.com/b14g_network/status/2116570456245596580), which names the attacker addresses, and Core DAO's statement (https://x.com/Coredao_Org/status/2116582149101121618). Details may change; refer to the original source for the authoritative record.