b14g: One Transaction Took 97M CORE (About $1.47M) From a Bitcoin Staking App
On 31 October one transaction pulled about 97 million CORE, worth about $1.47M, out of b14g, a Bitcoin staking app. b14g says exchanges froze 9M CORE.
Key numbers
~$1.47M
Stolen (estimate)
97.05M CORE
Tokens taken
About 9M CORE (per b14g)
Frozen by exchanges
Unidentified
Attacker
At 09:29 UTC on Saturday 31 October 2026, a wallet that had been empty two days earlier sent one instruction to b14g, a small staking service built on the Core blockchain. Within that one block, the wallet's balance went from about 616 CORE tokens to about 97 million. The money belonged to people who had parked their CORE with b14g to earn interest.
b14g's first statement on X came seven hours later. At 16:38 UTC it posted on X that "approximately 97M CORE staked through b14g was withdrawn without authorization and transferred to attacker-controlled addresses", that it had paused the affected contracts, and that exchanges had frozen about 9 million CORE linked to the attacker. The bitcoin its users had staked, it said, "remains time-locked on Bitcoin and was not affected."
How much was taken
Ninety-seven million sounds like a fortune. In dollars it is not. CORE, the coin of the Core network, traded at about $0.0151 on CoinGecko at 09:00 UTC on 31 October, the last hourly price before the drain. At that price the 97.05 million CORE taken was worth about $1.47 million. That figure is a CMZ estimate: neither b14g nor Core DAO, the organisation behind the network, has given a dollar value. At least one headline reported the loss as "$97M", which is the number of tokens, not dollars.
The size still matters. CoinGecko counts about 1.5 billion CORE in circulation, so the attacker took about 6.5% of all CORE in circulation, in one go. The coin traded only a few million dollars a day across all exchanges at the time, according to CoinGecko's volume figures. Selling 97 million of them quickly without crushing the price would be hard.
What b14g does
Core is a blockchain, a shared public ledger, that tries to borrow security from Bitcoin. Three groups choose the validators that run it: Bitcoin miners, who cast votes through the blocks they already mine, bitcoin holders who lock their BTC, and CORE holders who stake their CORE. Staking means lending coins to help run a network in exchange for interest, a little like a fixed-term deposit whose money keeps the bank's systems working. Core says there will only ever be 2.1 billion CORE.
Core pays much higher interest to people who stake both coins at once, which it calls dual staking. Most people own only one of the two. b14g set itself up as the matchmaker: CORE holders deposit CORE, bitcoin holders lock BTC, and b14g pairs them so both earn the higher rate. Its own posts advertised 15% to 20% a year or more on its dualCORE product, against about 6% for plain CORE staking. DefiLlama, which tracks money held in crypto apps, files b14g under restaking, the business of putting already-staked coins to work a second time for extra rewards. b14g also offers the same kind of matching on Babylon, another network that pays for staked bitcoin.
The bitcoin half of b14g is the larger part. DefiLlama listed about 3,170 BTC, roughly $245 million, held through b14g on 1 November. That bitcoin never left the Bitcoin blockchain: under Core's design it sits in the owner's own time-locked output on Bitcoin, which is why b14g says it was not affected. The CORE half was different. It sat inside b14g's own smart contracts, code that moves money by itself, on the Core chain.
One transaction, 99 positions
The public ledger shows what happened, though not why. The attacker's wallet, 0xc556...79f1, sent a single transaction to a b14g contract that the company's own published code on GitHub names "Marketplace". It is the contract that matches CORE stakers with bitcoin stakers. The transaction carried a list of 99 staking positions. For each one, the Marketplace contract recorded a withdrawal and named the attacker's wallet as the party withdrawing. Core's own staking system then released the CORE behind all 99 positions, and it landed in the attacker's wallet.
In stock-market terms, it is as if someone walked into a broker and filled in one form that closed 99 other clients' accounts and paid the proceeds to him, and the broker's system processed it. The transaction used about 11.5 million units of computing fuel, a very large single job, and it succeeded first time. No earlier failed attempts by that wallet appear on the ledger.
What the records cannot show is why the contract accepted the instruction. b14g has not said whether it was a missing permission check, a stolen key or something else. It has promised "a detailed post-mortem covering the technical cause and impact, along with next steps for affected users." b14g mentions only unnamed "security partners", and none of the reports on the attack names a security firm. And 99 positions are not 99 people: b14g has not said how many depositors were behind them.
Where the CORE went
Seven minutes after the drain, the attacker began moving the money in chunks. Between 09:37 and 10:10 UTC the first wallet sent eleven payments of 1 million to 2.9 million CORE each, 23.4 million in all, to fresh addresses that were used once and then passed the money on. At 10:36 it moved the remaining 73.6 million CORE to a second wallet, 0x2775...e92c, which sent out four more payments totalling 15 million between 10:41 and 10:47.
Each single-use address passed its CORE on once, most within minutes and all within about an hour. Three of the destinations behave like exchange wallets, where each customer gets a personal deposit address and the exchange sweeps it into its main wallet: one had made more than 625,000 transactions, far beyond any individual's use. Those three received about 28.9 million CORE. Two other destinations, which received 4.5 million between them, had never sent a transaction and still held exactly what arrived. Neither b14g nor Core DAO has named the exchanges involved. One payment of 5 million CORE came straight back to the attacker's second wallet at 10:50, which is what a refused or bounced deposit can look like.
By the morning of 1 November, the ledger showed about 63.6 million CORE still sitting in the attacker's second wallet, unmoved since that bounce. b14g's own count is that about 68 million CORE "remains on Core" and about 9 million is frozen. The ledger fits that count if the 68 million means the 63.6 million plus the 4.5 million parked in the two idle wallets. In that case, of the roughly 28.9 million that reached exchange-like wallets, about 9 million was frozen and about 20 million has no reported freeze.
Core DAO posted at 17:24 UTC that "the Core network is secure" and that CORE staked directly with validators or through other services was unaffected. "Most of the stolen CORE remains on Core, and exchanges are freezing deposits linked to the attacker," it said. Both organisations say they are tracing the money.
The aftermath
As of 1 November 2026, b14g's contracts remain paused and the company has not explained how the attack worked. It has promised a post-mortem with "next steps for affected users", but has not said whether it will repay the CORE taken, offered the attacker a bounty or opened talks. No exchange or security firm has been named. Neither b14g nor Core DAO has said whether police have been told.
The recovery picture rests on where the coins sit. About 9 million CORE is frozen at exchanges, according to b14g, and about 20 million that reached exchange-like wallets has no reported freeze. About 63.6 million was still in a single attacker wallet on the Core chain on the morning of 1 November. CORE is the chain's own coin, so nobody can freeze it in an ordinary wallet without the chain itself stepping in. Core DAO said it is helping to trace and freeze the funds, but it has not proposed any change to the chain to do so.
It is Core's second security scare in two months. In late August Core DAO found that a few validators were drawing more rewards than the rules allowed, paused staking rewards network-wide and pushed through a hard fork that burned more than 150 million CORE of excess issuance. Nobody has suggested any link between the two. b14g's bitcoin side, about 3,170 BTC according to DefiLlama, was not touched. CMZ counts the incident at about $1.47 million, the value of the 97.05 million CORE at the price shortly before the theft, under its rule that frozen or returned money does not lower a hack's figure.
What this teaches
- Count tokens and dollars separately. 97 million CORE was worth about $1.47 million, and at least one headline turned the token count into "$97M".
- Where the coins sit decides the risk. Bitcoin locked on its own chain under the owner's time lock was untouched; CORE held inside b14g's own contract was not.
- One contract call can empty many accounts. A single transaction withdrew 99 positions because the contract accepted the attacker as the party withdrawing.
- Freezes only work at the exchange door. About 9 million CORE was frozen after reaching exchanges; the 63.6 million left in the attacker's own wallet is beyond any exchange's reach.
- Promised post-mortems are not answers. A day after the theft, users had no cause, no repayment plan and no list of exchanges that froze funds.