b14g says 97 million CORE staked through it was withdrawn without authorisation

UPDATED 04:53 UTC, 1 Nov: Core DAO said on X at 17:24 UTC on 31 Oct that “the Core network is secure”: consensus, validators and staking contracts operated normally, and CORE staked directly with validators or through other protocols was unaffected. It said it is helping b14g and exchanges trace and freeze the funds, and that most of the stolen CORE remains on Core. b14g had published no post-mortem as of 04:53 UTC.

At a glance

• b14g says about 97 million CORE tokens staked through it, roughly $1.34 million at Saturday evening’s price, were withdrawn without authorisation at 09:29 UTC on 31 Oct and sent to two attacker-controlled addresses.
• The project says about 68 million CORE is still on the Core blockchain and exchanges have frozen about 9 million; bitcoin staked through b14g is time-locked on Bitcoin and was not affected.

b14g, a bitcoin staking hub built on the Core blockchain, said about 97 million CORE staked through its contracts was withdrawn without authorisation on Saturday morning, in a security update on X at 16:38 UTC.

The funds were moved to “attacker-controlled addresses”, the project said. It paused the affected contracts once the withdrawals were found.

b14g said it is working with the Core team, security partners and exchanges “to investigate the incident, trace the funds and coordinate freezing and recovery efforts”. It has not said how the withdrawals were made.

What was hit

Only CORE staked through b14g was affected, the project said. Bitcoin that users staked through b14g “remains time-locked on Bitcoin and was not affected”, it said.

b14g lets bitcoin holders lock their coins on the Bitcoin network, without handing them over, and pairs them with CORE stakers to share rewards, a model it calls dual staking, according to its documentation.

Based on its tracing so far, b14g said about 68 million CORE remains on Core and exchange partners have frozen about 9 million CORE linked to the attacker.

One of the two addresses b14g named, 0x27758c30…e92c, held about 63.6 million CORE at 20:49 UTC, according to a CryptoWatchDesk read of Core’s public node. The other held almost nothing.

Context

The incident comes in a heavy week for bitcoin-linked infrastructure. On Friday night, Threshold’s tBTC bridge paused minting and redemptions for security maintenance; Threshold said on Saturday that no funds were lost. Nothing links the two events.

CORE was trading at $0.0138 as of 20:48 UTC, down 9.0% in 24 hours, according to CoinGecko. The dollar figures above are our arithmetic at that price.

b14g said it will publish a detailed post-mortem on the technical cause and impact, with next steps for affected users.

Get the week’s raises and deals in The Ledger Weekly.

Related: On 1 Nov, Blockaid said Premia vaults on Arbitrum were drained of about $400,000

This article is for information only and is not investment advice.