Bitcoin staking platform b14g is investigating an exploit in which attackers withdrew approximately 97 million CORE tokens from its staking contracts on Saturday, October 31. The unauthorized withdrawals occurred at 09:29 UTC, moving the tokens to attacker-controlled addresses. Upon discovery, b14g paused the affected contracts and began working with the Core team, security partners, and exchanges to trace and recover the funds.
Initial tracing found about 68 million CORE still on the Core network, while exchange partners froze roughly 9 million tokens linked to the attacker. The platform has not yet disclosed the full extent of user losses or explained how the exploit happened, and a detailed post-mortem is promised. Two attacker-controlled addresses have been identified so far.
Importantly, Bitcoin deposited through b14g was not affected: those assets remain time-locked on the Bitcoin network. Core DAO confirmed that its network, validators, and staking contracts continued operating normally, and CORE staked directly with validators or through other protocols was untouched. The incident is therefore limited to CORE tokens staked through b14g's contracts, not a compromise of the underlying Bitcoin deposits or the Core chain itself.
Why it matters
This exploit is a reminder that in crypto, the weakest link is rarely the base blockchain — it is the layer of smart contracts built on top of it. The Core network kept running fine; it was b14g's staking contracts that were drained. Users who staked directly with validators were untouched, while users who routed through an intermediary took the hit. That distinction is the whole story of DeFi risk in one incident.
It also lands in a brutal week for crypto security, days after the record Binance theft. Each incident chips away at the trust that keeps users' funds in these platforms, and each one follows the same pattern: a pause, a partial freeze, and a post-mortem promised later. Until platforms can show how an exploit happened — not just that it did — users are being asked to trust the same contracts twice. For anyone staking through a third-party protocol, the question to ask is no longer what yield it offers, but what happens to your tokens if its contracts fail.
Source: CoinEdition — b14g Probes $97M CORE Token Exploit as Staking Contracts Face Shutdown (November 1, 2026). Summary rewritten by VCTRIA.
