Zero-token withdrawals let a hacker drain 97 million CORE from Bitcoin staking platform b14g

Bitcoin staking platform b14g suffered a $1.47 million exploit on Oct. 31, losing approximately 97 million CORE tokens.

The attacker drained 91 staking positions in a single transaction by submitting withdrawal requests for zero CORE, according to an investigation by blockchain analytics firm Bitquery.

The staking platform confirmed the unauthorized withdrawals and said it had paused the affected contracts while coordinating with the Core team, security partners, and exchanges to recover the funds.

However, b14g clarified that the breach was limited to CORE deposits. Bitcoin staked through the protocol remains time-locked on the BTC blockchain and was not affected.

How hackers exploited b14g's withdrawal mechanism

Bitquery's investigation revealed that the attacker exploited a weakness in the interaction between b14g's withdrawal mechanism and Core's staking contracts.

Under normal circumstances, b14g allows Bitcoin holders to pair their BTC with CORE deposits to earn enhanced staking rewards. The protocol manages these arrangements through staking positions that hold CORE and delegate it to validators.

However, Core's staking contract contains an unusual provision that interprets a withdrawal request for zero tokens as an instruction to withdraw the entire staked balance.