Zero-token withdrawals let a hacker drain 97 million CORE from Bitcoin staking platform b14g

Bitcoin staking platform b14g suffered a $1.47 million exploit on Oct. 31, losing approximately 97 million CORE tokens. The attacker drained 91 staking positions in a single transaction by submitting withdrawal requests for zero CORE, according to an investigation by blockchain analytics firm Bitquery. The staking platform confirmed the unauthorized withdrawals and said it had paused the affected contracts while coordinating with the Core team, security partners, and exchanges to recover the funds. However, b14g clarified that the breach was limited to CORE deposits. Bitcoin staked through the protocol remains time-locked on the BTC blockchain and was not affected. Bitquery's investigation revealed that the attacker exploited a weakness in the interaction between b14g's withdrawal mechanism and Core's staking contracts.