How 99 requests to withdraw zero drained 97 million CORE ($1.47 million) from b14g
A new wallet asked b14g, a Bitcoin staking app on Core, to withdraw zero tokens 99 times. Core's staking code read each one as "withdraw everything." About 70% of the coins had still not moved by that evening.
Key points
- On October 31, 2026, one transaction took 97.05 million CORE, about $1.47 million, from 91 b14g staking orders.
- The attacker asked to withdraw 0 CORE 99 times, and Core's staking code treats 0 as "withdraw it all." No key was stolen.
- b14g paused withdrawals 66 minutes later. About 68 million CORE had not moved by evening, and b14g says exchanges froze about 9 million.
What was taken
On Saturday, October 31, 2026, at 5:29:51 a.m. ET (09:29:51 UTC), one transaction emptied 91 staking orders on b14g and took 97,045,563 CORE, worth about $1.47 million. The trick: the wallet asked to withdraw zero, and Core's staking code reads zero as everything.
b14g is a Bitcoin staking app on Core, a blockchain that pays bitcoin holders extra rewards when they lock up the chain's own CORE token next to their BTC. b14g matches the two sides: bitcoin holders open orders, and CORE holders fill them with their coins. The stolen coins went to a wallet about half an hour old that had never put a coin into any of the orders, according to an on-chain investigation by Bitquery.
The headline number sounds huge, but CORE trades at a low price. Bitquery valued the haul at $1.47 million, using a price of $0.0151 just before the drain. The SlowMist Hacked database lists the loss at $1.36 million. Neither figure is close to the $97 million that one early post on X suggested by reading the coin count as dollars.
How 'zero' became 'everything'
A normal b14g withdrawal names an order, its validator (one of the computers that run the chain) and an amount. b14g passes that request to Core's staking contract, which releases the coins. Bitquery found eight such withdrawals from October 28 until the drain, and each paid out exactly what was asked.
The attacker sent the same kind of request 99 times, but each asked for 0 CORE. Core's staking code reads a request for 0 as a request for everything the staker holds with that validator. In the chain's eyes, each b14g order is the staker. So when b14g passed the zero along, the whole order came out.
Bitquery said b14g let the zeros through from a wallet that had funded no order. It found no sign of a stolen key and no new code: the contract logic running during the drain had been in place for 17 months. Bitquery added that it has not seen b14g's code, so it cannot point to the faulty line.
In simple terms: a shortcut that made sense for someone closing their own position became dangerous once a middleman let anyone send that request for orders they did not own.
Timeline
New wallet receives 615.62 CORE for fees, its only funding
99 zero-amount requests empty 91 orders: 97.05 million CORE
23.4 million CORE moves out through 11 new addresses
b14g's multisig pauses the contract, 66 minutes after the drain
b14g posts its security update on X
Core DAO posts that its network is secure
Where the coins are now
Bitquery read the chain at 3:43 p.m. ET on October 31. By then 68.15 million CORE, about 70% of what was taken, had not moved: 63.65 million sat in the attacker's second wallet and 4.5 million in two new wallets. That matches b14g's own figure of about 68 million still on Core. The other 28.9 million reached exchanges or swap services.
b14g also said exchange partners froze about 9 million CORE linked to the attacker. Bitquery noted that freezes happen inside exchanges and do not show on the chain, so it could not check that claim.
b14g incident: where the CORE stood on October 31
million CORE
Sources: Bitquery, citing b14g for the frozen amount
The 66 minutes and the money trail
b14g's contract has a pause switch that stops all withdrawals. It came on at 6:35:51 a.m. ET, 66 minutes after the drain, Bitquery found. In that window 23.4 million CORE left the attacker's first wallet through new addresses. Forty-two seconds after the pause, the rest moved to a second wallet.
b14g said it paused the contracts as soon as it found the problem. Bitquery said the chain cannot show when that was.
Bitquery traced coins to a Bybit hot wallet and to deposit addresses its labels tag as Bybit, Gate.io and MEXC. One unlabeled service, which it called service Y, sent the attacker's wallet its 615.62 CORE for fees half an hour before the drain. Later that morning the same service took in about 11 million of the stolen coins and passed them to a MEXC deposit address. Bitquery called this the clearest lead it found, since a swap service may hold records of who paid for the fee money.
What b14g and Core say, and the price
According to Bitquery's summary of the posts, b14g said bitcoin staked through its service was not affected, and Core DAO said its network and staking contracts worked normally throughout. Bitquery checked the second claim and agreed: the staking contracts paid exactly what b14g's orders asked for.
CORE's price slid after the theft. Bitquery, using CoinGecko data, put it at $0.0139 by 3:43 p.m. ET, 8.5% lower than 24 hours earlier. On November 2 CoinGecko listed an all-time low of $0.01308, with CORE trading about 4.6% above it and a market value near $20.5 million. That is down from about $23.4 million in CoinGecko's daily data for October 30.
LC Insight analysis
This section is our reading of the facts above, not a statement of fact.
- This is a textbook integration bug. Core's zero-means-all rule was harmless on its own. The damage came when b14g built a shared layer on top without checking who was allowed to ask.
- The 66 minutes before the pause matter as much as the bug. Faster monitoring could have kept more than 23 million CORE from leaving the first wallet.
- We expect every service built on Core's staking to review how it passes withdrawal requests through. With 70% of the coins still unmoved, recovery depends on freezes or a deal with the attacker.
What's next
- A b14g postmortem and any compensation plan for the 91 orders
- Any movement from the wallets holding 68 million CORE
- Whether the exchanges named by Bitquery confirm freezes
Disclaimer. This article is based on public information and the sources listed below as of the update time shown. It is for information only and is not investment, legal or tax advice. Figures may change as companies and authorities publish new data.
