b14g Zero-Withdrawal Staking Exploit

On October 31, 2026, b14g — a restaking and yield protocol built on Core and Babylon — was drained of roughly 97 million CORE, worth approximately $1.47 million at the pre-attack price, after an attacker exploited how the protocol forwarded withdrawal requests to Core's staking system. There was no stolen key and no oracle manipulation: the loss came from a smart-contract logic flaw triggered by a withdrawal of zero tokens.

What happened

Beginning at 09:29 UTC, the attacker submitted 99 zero-value withdrawal requests against staking positions it had never funded, according to Bitquery's analysis. Core's staking contract reportedly interprets a zero-token withdrawal as an instruction to release the entire staked balance, and b14g's contract passed the malformed requests straight through. In a single transaction the attacker drained 91 staking positions, collecting 97,045,563 CORE in total. b14g paused the affected contracts at 10:35 UTC, about 66 minutes later, but in that window the attacker had already routed some 23 million CORE through fresh addresses. Core DAO stressed that its base layer was never compromised: consensus, validators and CORE staked directly with validators all operated normally, and Bitcoin staked through the protocol remained time-locked and untouched — the flaw lived entirely in the b14g integration layer.

Aftermath

Recovery was unusually substantial for a DeFi exploit. On November 2, Core executed a hard fork that moved 68,146,177.22 CORE — about 70% of the stolen total — out of three attacker-controlled addresses into a recovery address; Core DAO stressed the one-time state adjustment reversed no transactions, minted no tokens and did not change CORE's total supply. Separately, b14g reported that exchange partners had frozen roughly 9 million CORE linked to the attacker, with funds traced through intermediaries tied to Bybit, Gate.io and MEXC. A message signed "b14g Team" later offered the attacker a 10% bounty for the voluntary return of the remainder, setting a November 6 deadline. A full post-mortem and a user-compensation plan were still pending at the time of reporting.

Why it matters

The b14g exploit is a stark example of a composability trust gap: a safe-looking base protocol (Core's staking system) behaved exactly as designed, but an integration built on top of it forwarded an edge-case input — a zero-amount withdrawal — that unlocked balances the caller never owned. It echoes other restaking and vault logic failures such as KelpDAO and Premia, where the money was lost not to broken cryptography but to an unchecked assumption at a contract boundary. The episode is also a rare demonstration that an L1 can claw back a majority of stolen funds through a coordinated hard fork when the loot sits idle in traceable wallets.