Bitcoin Staking Platform b14g Suffers $1.47 Million Exploit Using Zero Token Requests

On October 31, the Bitcoin staking platform b14g suffered an exploit that resulted in a loss of approximately 97 million CORE tokens, valued at $1.47 million. According to an investigation by blockchain analytics firm Bitquery, the attacker managed to drain 91 staking positions in a single transaction by submitting withdrawal requests for zero CORE. The incident occurred at 09:29 UTC, and the stolen assets were quickly transferred to an attacker-controlled wallet.

Under normal operations, b14g allows users to pair their Bitcoin holdings with CORE deposits to receive enhanced staking rewards. The platform uses staking positions to hold CORE and delegate it to validators. However, Bitquery revealed that an unusual provision in Core's staking contract interprets any zero-value withdrawal request as an instruction to withdraw the entire staked balance. The attacker exploited this behavior by submitting 99 requests against unfunded staking positions. The b14g contract accepted these instructions and forwarded them to the Core staking system, releasing the tokens.

Zero-token withdrawal requests allowed an attacker to drain 97 million CORE from b14g.

Zero Token Architecture And The Attack Vector

While the underlying contract logic had been in place for approximately 17 months, Bitquery noted that it had not reviewed the source code to find the precise programming error. The investigation found no evidence that the attacker required a newly deployed malicious contract or a compromised administrator key. Blockchain records indicate that b14g did not pause the affected contracts until 10:35 UTC, roughly 66 minutes after the attack began. During this window, the attacker moved 23 million CORE through newly created addresses.

Following the breach, b14g confirmed the unauthorized withdrawals and stated that it paused the affected contracts while collaborating with security partners, the Core team, and exchanges to retrieve the funds. The platform clarified that only CORE deposits were compromised, while Bitcoin staked through the protocol remained safe and time-locked on the BTC blockchain. Core DAO also maintained that its underlying blockchain, validators, and consensus mechanism were unaffected.

Tracing efforts showed that some stolen funds passed through intermediary addresses linked to exchange infrastructure, including Bybit, Gate.io, and MEXC. Additionally, a service that funded the initial transaction fees received roughly 11 million CORE and forwarded them to an MEXC deposit address. By the evening of October 31, about 68 million CORE remained unmoved in three wallets, while exchange partners successfully froze approximately 9 million CORE.

Why it matters

The exploit highlights critical security vulnerabilities in how decentralized finance protocols interact with underlying blockchain staking architecture. While user funds involving locked Bitcoin remained secure, the breach disrupted operations and underscored the risks associated with unexpected contract behaviors regarding zero-value inputs.