THE BLOCK: Bitcoin staking protocol b14g lost about 97 million CORE (~$1.5M) on Saturday after an attacker asked to with | Hanami
THE BLOCK: Bitcoin staking protocol b14g lost about 97 million CORE (~$1.5M) on Saturday after an attacker asked to withdraw 0 tokens from 91 positions it didn’t own. Core’s staking code reads 0 as "withdraw everything," and b14g let the requests through, per Bitquery.
b14g said it paused the affected contracts and that about 68 million of the stolen CORE remains on Core, while exchanges have frozen roughly 9 million. BTC staked through b14g stays time-locked on Bitcoin and was not affected. The team has promised a post-mortem on the technical cause.
Core DAO said its network is secure and its validators and staking contracts operated normally throughout. CORE staked directly or through other protocols was not affected.