b14g Security Incident: How a Zero-Amount Flaw Drained 97M CORE
The b14g security incident of October 31, 2026, now has a detailed explanation and a repayment plan.
A staking protocol lost about 97 million CORE in one transaction, yet most of it was later recovered.
This report covers what happened, why it happened and what affected users should expect, based on the team’s own post-mortem and updates.
What Happened on October 31
At 09:29 UTC on October 31, about 97 million CORE staked through the protocol were withdrawn without authorization and sent to addresses controlled by an attacker, as the team’s first update states.
Staking simply means locking tokens to help run a blockchain and earn rewards.
The team paused the affected contracts, the programs that hold and move staked funds, as soon as it noticed.
Bitcoin staked through the protocol stayed time-locked on the Bitcoin chain and was not affected.
The update added that about 68 million CORE remained on the chain and that exchange partners had frozen about 9 million linked to the attacker.
On-chain price data from before the attack put the amount near $1.5 million, because the token trades at a very low price.
Item
Figure
Time
Oct 31, 2026, 09:29 UTC
Amount affected
97,045,563 CORE
Recovered by chain upgrade
68,146,177.22 CORE (70.2%)
Frozen by exchange partners
About 9 million CORE
Bitcoin staked through the protocol
Not affected
How One Zero-Amount Request Emptied Staking Orders
The post-mortem explains the cause in plain terms. The staking contract on the chain was changed so that a withdrawal request for zero tokens releases a delegator’s entire stake, much like a cash machine where typing 0 means “withdraw everything.”
The protocol’s contracts did not account for that change. Its check only asked whether the requested amount was larger than the staked balance.
Zero is never larger, so the request passed and was forwarded to the chain’s staking contract.
The attacker used the normal withdrawal function with an amount the protocol had failed to block, and 91 staking orders were emptied in a single transaction.
In short, this b14g security incident was a gap in input checks, not a break in the base chain.
Core DAO said its validators and contracts kept running normally and that funds staked directly with validators or through other protocols were unaffected.
A Chain Upgrade Brings Back 70.2% of the Funds
On November 2, the chain carried out a coordinated upgrade, called a hard fork, that made a one-time balance adjustment.
A hard fork means validators run new software at a set time, so the change applies everywhere at once.
It moved 68,146,177.22 CORE from three attacker-controlled addresses to a designated recovery address.
That equals 70.2% of the 97,045,563 CORE affected, as the team’s recovery update explains. The adjustment did not reverse transactions, create new coins or change total supply.
Simple subtraction leaves about 28.9 million CORE outstanding, including roughly 9 million frozen by exchange partners and not yet returned.
The team said it is working with exchanges and law enforcement on those funds.
How Affected Users Will Be Repaid
After verifying balances for every affected staking order, the team says it will repay users in two parts.
For holders, the b14g security incident, therefore, has a clear repayment path:
Part one: the recovered 68.15 million CORE go back to the affected orders within five to seven days.
Part two: the remaining amount is repaid using 50% of the protocol’s future revenue from staking on the chain, and users can claim their share every week.
Bonus: any additional funds recovered from exchange freezes will be added to repayments.
Part one: the recovered 68.15 million CORE go back to the affected orders within five to seven days.
Part two: the remaining amount is repaid using 50% of the protocol’s future revenue from staking on the chain, and users can claim their share every week.
Bonus: any additional funds recovered from exchange freezes will be added to repayments.
Because part two depends on future revenue, the speed of full repayment is not fixed.
Fixes and Safety Reminders
The team will add checks that reject zero and invalid withdrawal amounts, instead of relying on the chain’s staking contract to reject them.
It also plans to review its integration whenever the chain changes its staking system.
Users can protect themselves in three simple ways:
Use only links shared on the team’s verified channels.
Never share private keys or seed phrases with anyone offering recovery help.
Keep tracking the official updates for claim details.
Use only links shared on the team’s verified channels.
Never share private keys or seed phrases with anyone offering recovery help.
Keep tracking the official updates for claim details.
Conclusion
The b14g security incident shows how one missing input check can empty staking orders even when the main chain works as designed.
With 70.2% recovered and a two-part repayment plan, the focus now moves to returning funds and closing the gap.
This article is for information only and is not financial advice.
Disclaimer
This article is for educational and informational purposes only and is not financial or investment advice. Crypto assets are high risk, their prices can be very volatile, and you can lose some or all of your money. Always do your own research and consider speaking with a licensed financial advisor before making investment decisions.
About the Author Bablu Singh Nirwan
English Blog Writer at coingabbar.com
Bablu Singh Nirwan is a Content Writer with 6 months of experience covering blockchain, cryptocurrency, Web3, and digital finance. He specializes in researching emerging trends, simplifying complex topics, and creating SEO-optimized content. His work focuses on clarity, accuracy, and engaging insights that keep readers informed about the evolving crypto industry.
Frequently Asked Questions (FAQ)
