b14g confirms unauthorized withdrawal of about 97 million staked CORE
b14g says about 97 million CORE staked through its service was withdrawn without authorization on October 31. It reports pausing affected contracts upon discovery. This is a token count, not dollars or users; the readable portion of the original notice does not establish a final cause, verified fix or repayment plan.
- Disclosed
- Oct 31, 2026
- Updated Nov 1, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- CORE staked through b14g; do not infer that the Core network or every asset supported by b14g was compromised
- crypto
- In the wild
- Yes
- b14g directly confirms unauthorized withdrawals to attacker-controlled addresses.
What happened
The operator describes unauthorized withdrawals and attacker-controlled recipients, rather than an unexplained transfer. That confirmed asset theft supports L4. Approximately 97 million CORE must not be reported as $97 million. The readable opening of the vendor’s October 31 notice confirms the pause but does not establish when discovery occurred or how quickly the pause followed the withdrawal. Its later text could not be read in full, so later tracing, frozen-fund, unaffected-asset and compensation claims are not established here. Frozen or traced assets would not by themselves prove that users have been repaid.
November 1 research update: Bitquery reports that a wallet with no funded orders submitted 99 requests for zero CORE, emptying 91 orders. Its analysis says the downstream staking contract interprets zero as full withdrawal. This is a transaction-based finding, not a source-code audit or final vendor root cause. The researcher places the pause at 10:35:51 UTC on October 31, about 66 minutes after the drain; that does not establish when b14g discovered it. The vendor’s pause statement remains valid. Its 19:43 UTC balance snapshot is historical and cannot prove exchange freezes or repayments. The verified-fix and exit-procedure gaps remain.
Crime-scene timeline
Oct 31, 09:29 UTC
Unauthorized withdrawal of staked CORE
b14g gives this explicit UTC time for the withdrawal of approximately 97 million CORE.
Oct 31, 2026
b14g publicly confirms the incident and reports pausing affected contracts
Oct 31, 2026
Bitquery publishes a zero-amount withdrawal analysis
The researcher reports 99 zero-amount requests draining 91 orders and an on-chain pause 66 minutes later; source code and discovery time were not established.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- b14g original security updatePrimaryPublic embed confirms the amount in CORE, withdrawal time and contract pause; the remainder is truncated.
- Official public embed of b14g's updatePrimary
- Bitquery original b14g on-chain investigationPrimaryOctober 31 transaction analysis and role-labelled address ledger; researchers did not inspect b14g source code or verify the Bitcoin side.