The b14g exploit has taken about 97 million CORE tokens that users had staked through the platform, b14g said on Saturday. In a security update on X posted at 16:38 UTC, the Bitcoin yield platform said: “At 09:29 UTC today, approximately 97M CORE staked through b14g was withdrawn without authorization and transferred to attacker-controlled addresses.”
b14g said it “immediately paused the affected contracts” once it found the withdrawals, and is “working closely with the Core team, security partners and exchanges to investigate the incident, trace the funds and coordinate freezing and recovery efforts”. Bitcoin staked through b14g was not touched, the company said.
In brief
- b14g says about 97M CORE staked through it was withdrawn without authorisation at 09:29 UTC on 31 October.
- About 68M CORE remains on the Core network and exchanges have frozen about 9M, according to b14g; BTC staked via b14g was not affected.
- Users should rely only on b14g’s official channels and ignore anyone offering to “recover” funds.
What b14g says happened in the b14g exploit
b14g describes itself on X as “the coordination layer for BTCFi yield and security”, and its website advertises “no-loss Bitcoin restaking”. Users stake both BTC and CORE, the native token of the Core blockchain, through its contracts. b14g says the affected assets are “CORE staked through b14g”, while “BTC staked through b14g remains time-locked on Bitcoin and was not affected”.
On tracing so far, b14g said, “approximately 68M CORE remains on Core”, and “exchange partners have frozen approximately 9M CORE linked to the attacker”. It has not named the exchanges. It published two attacker addresses: 0xc556ed208285406d71705927f92d4f4eaea579f1 and 0x27758c30f8e424fbd8ca605bf31e9496c26ce92c.
TSN read both addresses on Core’s public network at about 16:50 GMT. The second address held about 63.6 million CORE; the first held a fraction of a single token. Neither is a smart contract. b14g has not said how its 68M figure breaks down across addresses.
b14g has not given a dollar value, a cause or a count of affected users. It said it will “publish a detailed post-mortem covering the technical cause and impact, along with next steps for affected users”. TSN found no separate statement from Core DAO or the Core Foundation by Saturday evening.
What b14g users should do now
The safest course for anyone with funds on b14g is to wait for official instructions. Follow only b14g’s verified X account, @b14g_network, and the website linked from it, and check any announcement against both before acting.
Incidents like this draw impersonators quickly. Fake “recovery” services, lookalike support accounts and unsolicited direct messages often appear within hours. Anyone who asks for a seed phrase, a private key, an upfront fee or a wallet signature to “release” funds is not helping. b14g said its “immediate priority is protecting users and recovering the affected funds”, and next steps for users are due with the post-mortem.
Users who also hold positions elsewhere can review and revoke old token approvals with a reputable approvals tool, but that is general hygiene. b14g has not said approvals played any part.
Why the frozen and traced CORE matters
The numbers b14g has published so far point to an unusual position for a drain of this size. If its tracing holds, most of the withdrawn CORE has not left the Core network, and a further slice is sitting frozen at exchanges. That matters because funds that stay on one chain, in addresses everyone can see, are far easier to follow than funds that have been bridged out or spread across many wallets. TSN’s own read found the bulk of the balance in a single plain wallet.
Visibility is not recovery, though. A frozen balance at an exchange can be returned through that exchange’s processes; tokens held in an attacker’s own wallet generally cannot be moved without the attacker’s key, short of action at the level of the network itself. b14g’s update mentions “freezing and recovery efforts” with the Core team but does not say what the Core team can or will do.
The separation between BTC and CORE is the other point to watch. b14g’s design kept staked bitcoin time-locked on Bitcoin itself, and it says that part was untouched. The loss sits in the CORE side of the system. Pausing contracts quickly is a familiar first response, as when Swell paused swETH and rswETH last week; what separates incidents afterwards is how much of the money can still be traced, as the zkLink Nova bridge and Tranche vault on Avalanche drains showed.
A busy week for crypto security
This is the latest in a run of incidents tracked on TSN’s crypto hacks and exploits hub. TSN reported on Saturday that DNS hijacks at Flap and Kintsu sent visitors to a wallet drainer through the projects’ own web addresses, a reminder that scammers target the routes users take to a platform as much as its contracts.
What comes next
The next fixed point is b14g’s post-mortem, which it says will cover the technical cause, the impact and next steps for affected users. Until then, the cause of the b14g exploit and the dollar scale of the loss remain unconfirmed.
Sources
- b14g on X: b14g Security Update (31 Oct 2026)
- Core explorer: attacker address 0x2775…ce92c
- Core explorer: attacker address 0xc556…579f1
- b14g website
Related stories
- zkLink Nova Bridge Drained of About $786,000, Blockaid Says
- Attacker Drains $1.01m in USDC From a Tranche Vault on Avalanche
- Swell Pauses swETH and rswETH After Suspected Hot-Key Compromise
- Flap and Kintsu DNS Hijacks Sent Visitors to a Wallet Drainer
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
