Saturday, October 31, 2026

b14g

Funds lost

$1.4M

Attack type

Other

Category

Yield Aggregator

Summary

On October 31, 2026, b14g a Bitcoin liquid staking application deployed on the Core blockchain, suffered a smart contract exploit draining approximately 97.05 million CORE tokens (~$1.4M to $1.47M USD). The underlying Bitcoin staked via b14g remains time-locked on the native Bitcoin network and was completely unaffected.

Details of the Exploit

The breach was triggered by a single transaction that targeted 91 b14g staking positions by submitting withdrawal requests specifying an amount of 0 CORE. Due to a logic flaw in the interaction between b14g and Core's underlying staking contracts, passing a zero parameter was misinterpreted by the staking code as a request to release the maximum available staked balance for each targeted order. This allowed the attacker to extract 97.05M CORE into controlled wallets without putting up collateral or holding valid claim rights.

Approximately 66 minutes post-incident, b14g paused its contracts to halt further unauthorized drains. On-chain tracing revealed that around 68 million CORE (~70% of stolen funds) remained unmoved on Core, while centralized exchanges (including Bybit and ChangeNOW/MEXC) succeeded in freezing approximately 9 million to 11 million CORE linked to the attacker.

Source: De.Fi REKT Database. Data as of November 3, 2026.