The b14g exploit was caused by a critical logic error in the platform's smart contract that allowed 'zero-token withdrawals' to trigger unauthorized asset transfers. By submitting a withdrawal request for zero CORE tokens, the attacker successfully bypassed standard validation checks, causing the protocol to release the full balances of 91 different staking positions to the attacker's wallet. The breach, which occurred on October 31, 2026, resulted in the loss of approximately 97 million CORE, equivalent to roughly $1.47 million.
Blockchain analytics firm Bitquery confirmed that the drain was executed with remarkable efficiency, occurring within a single transaction. This indicates that the attacker had precisely mapped the protocol's state-handling flaws before striking. The b14g team has since confirmed the unauthorized withdrawals and suspended platform activities to conduct a full security audit and prevent further drainage of user collateral.
For U.S. investors and DeFi participants, this incident underscores the growing 'smart contract risk' within the Bitcoin-layer ecosystem (BTCFi). As developers rush to bring yield-generating capabilities to Bitcoin through secondary protocols, security oversight often lags behind innovation. This specific exploit may draw the attention of U.S. regulators who are increasingly concerned about the safety of decentralized staking products offered to retail investors.
Market participants should closely monitor b14g’s upcoming transparency report and any potential reimbursement plans for affected users. The 97 million CORE tokens represent a significant liquidity event, and if the hacker attempts to wash these funds through decentralized exchanges, CORE price volatility is likely to increase. Furthermore, this event will likely force other Bitcoin-based DeFi protocols to re-evaluate their withdrawal logic to ensure they are not susceptible to similar zero-value transaction bugs.