Bitcoin dual-staking protocol b14g has paused affected CORE staking contracts after reporting that approximately 97 million CORE tokens were withdrawn without authorization on October 31. The project said the transfer occurred at 09:29 UTC and sent the assets to attacker-controlled addresses. Its initial notice separates the incident from the Bitcoin side of the product: CORE deposited through b14g was affected, while BTC remained time-locked on the Bitcoin network, according to the team. That distinction is central because b14g connects Bitcoin staking with yield activity on Core and Babylon, but exposure in one protocol component does not automatically establish a compromise of Bitcoin or the Core base network.

Core DAO says the network kept operating

Core DAO, which supports the Core ecosystem, said the network's consensus, validators and native staking contracts operated normally throughout the incident. It added that CORE staked directly with validators or through other protocols was unaffected. The statement narrows the reported failure to b14g's application-level contracts rather than Core's underlying chain. A protocol can lose assets even when the blockchain processing its transactions continues to work as designed, because the chain may faithfully execute a flawed or improperly authorized contract call.

Related reporting: Zano restarts chain before Hard Fork 6 after Gateway Address flaw

Onchain records match the reported timing

A transaction in Core's public block explorer, independently reviewed by Coindaro, records roughly 97.05 million CORE moving at 09:29:51 UTC. A later transaction from the multisignature owner paused the relevant vault at about 11:07 UTC, around 97 minutes after the withdrawal. Those records support the amount and sequence, but they do not explain why the contract allowed the movement. No public post-mortem has yet identified a software bug, compromised key, abused administrator privilege or other root cause.

Frozen tokens are not recovered funds

b14g said approximately 68 million CORE remained on the Core network when it issued its update and that exchange partners had frozen about 9 million tokens linked to the attacker. Those figures describe tracing and restrictions at a point in time; they do not show that the assets were returned to users. The project did not name the exchanges, disclose how many depositors were affected or provide a compensation timetable. It also has not explained the status of the portion that was neither described as remaining on Core nor frozen by exchanges.

What affected users still need to know

For CORE depositors, the immediate operational question is whether balances can be withdrawn or claimed while the affected contracts remain paused. For BTC stakers, b14g's time-lock statement is reassuring but still company-attributed; users need technical details on how rewards, exits and any cross-protocol accounting behave during the pause. Core DAO says it is helping b14g, security partners and exchanges trace the funds and coordinate freezes, but neither organization has announced a reopening date.

The post-mortem will determine the scope

b14g has promised a detailed report covering the technical cause, impact and next steps for affected users. Until that report appears, the incident should not be described as a Core network hack, a Bitcoin theft or a completed recovery. The confirmed facts are narrower: a large amount of CORE left b14g-linked contracts, the protocol paused affected components, some tokens were reportedly frozen, and the two organizations say the base network and time-locked BTC were not compromised. The unresolved questions are how authorization failed, whether more assets can move, and what remedy users will receive.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.