Zero-token withdrawals let a hacker drain 97 million CORE from Bitcoin staking platform b14g
Bitcoin staking platform b14g lost about $1.47 million, or 97 million CORE tokens, in an Oct. 31 exploit. The attacker submitted zero-token withdrawal requests against 91 staking positions. Core’s staking contract treated zero-value requests as instructions to withdraw the full balance, while b14g’s contracts accepted requests for positions the attacker had not funded. b14g paused the affected contracts about 66 minutes after the theft and is coordinating with Core, security partners and exchanges. About 9 million CORE was reportedly frozen, while roughly 68 million remained unmoved that evening. Bitcoin deposited through the protocol and CORE staked elsewhere were unaffected. Core DAO said its blockchain and staking systems were not compromised. b14g has promised a post-mortem but has not announced compensation.
