-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0296
============================================================

Advisory-ID:  0xCERT-2026-0296
Severity:     High
Published:    2026-10-31T16:38:15.000Z
Updated:      2026-11-01T04:41:52.468Z
Chains:       Other / Multi-chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0296

Title: b14g dual-staking protocol on Core: about 97M staked CORE withdrawn without authorization to attacker addresses

Summary
- -------
About 97M CORE staked through b14g was withdrawn without authorization on 2026-10-31 at 09:29 UTC and sent to attacker addresses. b14g paused the affected contracts. BTC staked via b14g is not affected. Exchanges should flag the two attacker addresses.

Details
- -------
Summary
b14g, a Bitcoin dual-staking and restaking protocol on Core, reported that about 97 million CORE staked through b14g was withdrawn without authorization at 09:29 UTC on 2026-10-31 and sent to attacker-controlled addresses. b14g paused the affected contracts and has not yet disclosed the technical cause. It says it will publish a post-mortem.

Affected
- - CORE staked through b14g's staking contracts on Core
- - BTC staked through b14g remains time-locked on Bitcoin and was not affected (per b14g)
- - CORE staked directly with Core validators or through other protocols was not affected, and the Core network itself was not compromised (per Core DAO)
- - No fix available at time of publication: the affected contracts are paused

Impact
About 97M CORE was withdrawn, worth roughly $1.3M at the CORE market price when this advisory was written (0xCERT estimate; neither b14g nor Core DAO has stated a USD figure). b14g says about 68M CORE remains on Core and that exchange partners have frozen about 9M CORE linked to the attacker. Exploitation in the wild is confirmed. The root cause has not been disclosed.

Recommended actions
- - b14g users: do not interact with b14g contracts until b14g confirms they are safe, and follow only b14g's official channels for recovery updates
- - Exchanges and bridges: flag and freeze deposits from the attacker addresses listed in the indicators
- - Beware of follow-on phishing that offers fake refunds or claims

Source & attribution
This 0xCERT advisory summarises b14g's security update (https://x.com/b14g_network/status/2116570456245596580), which names the attacker addresses, and Core DAO's statement (https://x.com/Coredao_Org/status/2116582149101121618). Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://x.com/b14g_network/status/2116570456245596580
- - https://x.com/Coredao_Org/status/2116582149101121618
- - https://www.tokenpost.com/news/technology/45685
- - https://coinedition.com/crypto-live-news/b14g-probes-97m-core-token-exploit-as-staking-contracts/
- - https://defillama.com/hacks

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrnE64JEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmf/iHrLhJY2UYTU1O9b/nt7zpun24ZRfEy2r+Gm
FRq0RxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADY7AEAvMRT79LVDkEgg5g6
w12zc9izpo1YbpZAgU8dpSTm5Q8BAJgnpCUy8eodn+0+e+MK906/vaYAaJqv
FgtJCK6y11QJ
=veyR
-----END PGP SIGNATURE-----