B14g Hack

Someone found a hole in a Bitcoin yield app and walked out with 97M CORE in one go. We read the transaction that did it, then followed the coins to the exchanges they reached.

97.05M CORE Taken from 91 b14g staking orders in one transaction at 09:29:51 UTC on 31 October, worth $1.47M.

Taken from 91 b14g staking orders in one transaction at 09:29:51 UTC on 31 October, worth $1.47M.

0 CORE Asked for in each of the attacker's 99 requests. The chain's staking code reads 0 as everything, so each order paid out in full.

Asked for in each of the attacker's 99 requests. The chain's staking code reads 0 as everything, so each order paid out in full.

66 min From the drain to b14g's pause. In that time, 23.4M left wallet A via new addresses.

From the drain to b14g's pause. In that time, 23.4M left wallet A via new addresses.

68.15M Not moved since the morning of 31 October: 63.65M in the attacker's second wallet and 4.5M in two new wallets.

Not moved since the morning of 31 October: 63.65M in the attacker's second wallet and 4.5M in two new wallets.

615.62 CORE The attacker's only fee money, sent 29 minutes before the drain by a service that later took 11.0M of the stolen coins.

The attacker's only fee money, sent 29 minutes before the drain by a service that later took 11.0M of the stolen coins.

66x How far an early post on X overstated the loss by reading the coin count as dollars. The loss was $1.47M.

How far an early post on X overstated the loss by reading the coin count as dollars. The loss was $1.47M.

01 · What happened The b14g hack: requests for 0 CORE took 97M

On Saturday morning, 91 staking positions on b14g were emptied at once. One transaction took 97 million CORE. At that morning's price it was worth $1.47 million. Every request in it had asked for nothing.

b14g is a Bitcoin staking app on Core, a blockchain that pays Bitcoin holders to lock up their BTC. Core has its own coin, CORE, and it pays more when a holder stakes CORE to their bitcoin. b14g matches the two sides. Bitcoin holders open what b14g calls merge orders , CORE holders fill them with their coins, and both the higher reward.

At 09:29 UTC, a wallet that had existed for half an hour, which we call wallet A, sent b14g a list of withdrawal requests. Each named a b14g order that the wallet had never put a coin into, and each asked for 0. Every order paid out in full, 97 million coins in all, to the wallet that asked.

b14g confirmed the theft on X seven hours later and named two attacker wallets. Core is not yet in Bitquery's own data, so we read the chain's public records directly, from the request itself to every transfer after it. The bug sat in the same withdrawal that b14g users had made every day since at least 28 October. It took b14g more than an hour to stop withdrawals, and the service that paid the attacker's fees took 11.0M of the loot later that morning.

02 · How b14g works How a b14g withdrawal works

Each b14g order is a small program on the chain, a contract, that holds CORE and keeps it staked with a validator, one of the computers that run the chain and earn its rewards. The bitcoin side never leaves Bitcoin. It sits in a time lock on the Bitcoin chain , locked until a set date.

To take coins out, a holder sends b14g three things: the order, its validator, and how much they want back. b14g passes the request to the staking contract, the part of Core's own code that holds every staked coin, and the coins come back.

From 28 October until the drain, 6 wallets made 8 such withdrawals through the same contract. Each asked for a set amount and got exactly that.

03 · Asking for zero How the b14g exploit worked: asking for 0 CORE

The attacker's request had the same shape, with one change. Every entry asked for 0 CORE.

Core's own staking code treats a request for 0 as a request for everything the staker has with that validator. Each b14g order is the staker in the chain's eyes. So when b14g passed a 0 along, the whole order came out.

b14g let the zeros through. Its contract logged each request as 0, and it took them from a wallet that had funded no order at all. The staking contract logged the full 97 million as released, and all of it went to the wallet that asked.

We have not seen b14g's code, so we cannot point to the faulty line. The record shows what got through: a request for nothing, from a wallet with no stake, paid in full. A single bad number did similar damage earlier this month in the WAX bridge hack , where a minus sign drained a bridge.

The orders were not small. Those holding more than 1 million coins each made up 90% of what was taken.

04 · No stolen key No stolen key and no new code

Some thefts start with a stolen key, as in the Predict.fun hack . Others start with new code pushed in a hurry. We checked both, and neither fits.

b14g's contract is a proxy, a fixed address whose logic its owners can swap. The logic it ran during the drain had been its standing version for 17 months. b14g's multisig, a wallet that needs several of its owners to sign, does upkeep by swapping in a helper and swapping the same logic back in one step. It had done that 36 times since late December, most recently the day before the hack, and each time it put the same logic back.

The attacker's wallet was new. Its only money was a small amount of CORE for fees, sent half an hour before the drain, and no b14g record named it before. Its first call to b14g was the drain itself.

05 · 66 minutes 66 minutes from the b14g drain to the pause

The contract has a pause switch, which stops every withdrawal. It took 66 minutes to come on.

Eight minutes after the drain, b14g's multisig ran its usual upkeep step on seven contracts, and withdrawals stayed open. Later, a user took out 80 CORE through the same function, the normal way.

b14g said it paused the contracts as soon as it found the problem. We cannot see when that was. The record shows the pause 66 minutes after the drain.

06 · Where it went Where the stolen CORE went: Bybit, MEXC and Gate.io

Each of the 15 new addresses received one transfer and sent it on in a single transaction. Twelve passed their coins to busy wallets, the way an exchange sweeps the deposit addresses it gives each customer into a main wallet. Two passed theirs to fresh wallets that have not moved since, and one sent almost everything back to wallet B.

Two of those twelve fed a Bybit hot wallet, the exchange's working wallet for payouts. Our address labels place the same address on Bybit's proof-of-reserves list, the wallets Bybit names on other chains to show it holds its customers' coins. The other ten fed two busy, unlabeled wallets we call service X and service Y. Both take coins through one-time deposit addresses and pass them on to large exchanges, the pattern of an exchange or a swap service.

Within 90 minutes, service X had moved some of what it took on to addresses that our labels tag as Bybit and Gate.io deposits. Service Y passed what it took to a MEXC deposit address the same morning. These services hold other customers' coins as well, so their later transfers show where CORE went that morning. They do not prove which coins were stolen.

The address that sent its coins back took 5M CORE from wallet B and returned all but 1 CORE three minutes later. We cannot tell who controls it.

07 · The fee money The service that paid the b14g attacker's fees

Every transaction on the chain costs a small fee, paid in CORE. A brand-new wallet has none, so the attacker needed some first.

Half an hour before the drain, service Y sent wallet A 615.62 CORE. It was the wallet's first and only funding. Odd amounts like that are typical when someone swaps another coin into CORE, though the record cannot show what was swapped.

Later that morning, service Y took in 11.0M of the stolen coins through four deposit addresses and passed it all to MEXC. If service Y is an exchange or a swap service, it may hold a record of the customer who paid for that fee money. It is the clearest lead we found.

08 · The claims Checking what b14g, Core DAO and X posts said

b14g, Core DAO and posts on X described the theft within hours. In its own post , Core DAO said its network and staking contracts worked normally throughout. We checked each claim against the chain.

One early post on X read the coin count as dollars and overstated the loss 66 times.

09 · CORE price CORE price after the b14g hack

The price held steady through the morning. It started to slide minutes after the first stolen coins reached the services, and lost 3% within half an hour.

10 · What What b14g users can watch now

Most of the stolen coins have not moved. Wallet B and the two new wallets have not touched them. Together they hold 70% of the theft, which matches b14g's own figure of 68M "on Core".

The rest reached exchange and service wallets. b14g says exchanges have frozen 9M of the coins. Freezes happen inside an exchange's own books, so the chain cannot confirm that figure. Two balances stand out. That evening, service X still held 9.34M CORE, and the deposit address our labels tag as Gate.io's had not passed on its coins. The chain cannot show whether either is frozen.

b14g has promised a full post-mortem. It also says the BTC staked through it stays locked on Bitcoin. We did not check the Bitcoin side. For anyone who staked through b14g, wallet B is the one to watch, and it has sent nothing since that morning. The same week, hackers drained Binance, and we traced where that money went in the Binance hack .

11 · How we checked Method and limits

We read the drain transaction, its payouts and every later transfer straight from Core's public node, then checked every wallet's balance on the evening of 31 October. Core Scan, Core's block explorer, gave us the lists of transfers for the two services, and we re-read each one on the node. Prices come from CoinGecko.

The exchange wallets are named from Bitquery's labels and from how the coins moved. Our address APIs do the same work on the chains Bitquery covers, and Bitquery runs this kind of tracing for clients through its crypto investigation services .

Balances were read from the chain's public node at block 40,054,403, 19:43 UTC on 31 October 2026. Anything after that is not covered.

Dollar values use CoinGecko's CORE price: $0.0151 at 09:25 UTC for the theft, and $0.0139 at 19:43 UTC for balances.

We call 0xc556 and 0x2775 wallets A and B. b14g named both as the attacker's. Services X and Y carry no label; we describe them by how they move coins.

The Bybit hot wallet's address is on Bybit's proof-of-reserves list in our labels, recorded on other EVM chains; Core uses the same addresses. The Bybit, Gate.io and MEXC deposit tags come from our labels. The Gate.io-tagged address had not swept its coins by the time of our reading.

We did not read b14g's source code. The cause described here is what the transaction records show.

We name Bybit, MEXC, Gate.io, Core DAO and CoinGecko only for the role their wallets, code or data play here. Nothing here suggests any of them did anything wrong.

12 · The addresses Where to look

These are the wallets and transactions behind this story, each linked to Core Scan, the chain's explorer.

Follow stolen coins across chains

Core is not in Bitquery's data yet, so this story was read from the chain's own public node. The exchanges at the end of the trail work across the chains Bitquery does cover. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which labels an address carries, without writing a query.

This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any protocol, exchange or service.

The findings describe transactions and balances observed on Core between May 2025 and 31 October 2026. Attributions come from Bitquery's address labels and from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.

References to b14g, Core DAO, Bybit, MEXC, Gate.io, CoinGecko, Blocmates or any other named project, company, service or person describe what the public record shows addresses and transactions linked to them, and what those parties have said in public. They are not statements any party's intent, practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or broke any rule or agreement.

Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.

Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.

Yes. On the morning of 31 October, one wallet emptied 91 b14g staking orders in a single transaction. It asked to withdraw 0 CORE from each, and Core's staking code reads 0 as everything, so each order paid out in full.

How much was stolen in the b14g hack?

97 million CORE, worth $1.47M at the price just before the drain. One early post read the figure as dollars by mistake.

We found nothing wrong with Core itself. Its staking contract did what b14g's orders asked. The fault was in how b14g passed the requests on. Core DAO says coins staked directly with validators, or through other apps, were not touched.

Where are the stolen coins now?

On the evening of 31 October, 70% of them had not moved, most in the attacker's second wallet. The rest went to a Bybit hot wallet and two services that pass coins on to Bybit, Gate.io and MEXC.

Is BTC staked through b14g safe?

b14g says the BTC staked through it stays locked on Bitcoin and was not affected. Bitcoin staked for Core sits in a time lock on the Bitcoin chain, and the theft took CORE only. We did not check the Bitcoin side.

What happened to the CORE price after the b14g hack?

The price fell 8.5% over the 24 hours to the evening of the hack. It started to slide minutes after the first of the loot reached exchange and service wallets.

Run the investigation in minutes

Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets , or query the chain directly with the Bitquery API .