b14g CORE staking orders (October 2026) hack — October 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | October 31, 2026 |
| Target type | Mining or staking operation |
| Loss | $1,470,000Price at time of incident |
| Recovered | $136,000 |
| Method | Contract logic errorOne transaction asked to withdraw 0 CORE from each of 91 b14g staking orders, and the staking code treats 0 as the whole balance, so every order paid out in full |
| Chains | Other |
| Outcome | Partially recovered |
What happened
At 09:29 UTC on 31 October 2026 about 97 million CORE staked through b14g, a Bitcoin and CORE dual-staking app on the Core chain, was withdrawn without authorisation and sent to attacker-controlled addresses. b14g paused the affected contracts and said the BTC staked through it stayed time-locked on Bitcoin and was not affected. Core DAO said its own consensus, validators and staking contracts were unaffected.
Bitquery found that one transaction emptied 91 staking orders, asking to withdraw 0 CORE from each; the staking code reads 0 as everything, so each order paid out in full, 97.05 million CORE worth about $1.47 million that morning. At CoinGecko’s 31 October average of $0.01548 the same tokens are worth about $1.50 million. CORE trades about $5 million a day, so this is a screen value: by the evening 68.15 million had not moved.
b14g said about 68 million CORE remained on Core and that exchange partners had frozen about 9 million linked to the attacker, recorded here as recovered at Bitquery’s rate. It has promised a post-mortem and next steps for affected users.
Sources
- b14g on X (31 October 2026)Primary · retrieved 2026-11-02
- Core DAO on X (31 October 2026)Primary · retrieved 2026-11-02
- Bitquery investigation (October 2026)Secondary · retrieved 2026-11-02
Changes to this entry
- Recorded at Bitquery’s $1.47m (morning price); high end is 97.05m CORE at CoinGecko’s 31 Oct average. Recovered = ~9m CORE frozen at exchanges per b14g. Vector provisional until b14g’s post-mortem.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "b14g CORE staking orders (October 2026) hack — October 2026", iTokenly, accessed 2026-11-02, https://itokenly.com/hacks/b14g-core-staking-october-2026https://itokenly.com/hacks/b14g-core-staking-october-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.