At 09:29 UTC on 31 October 2026, about 97 million CORE staked through b14g was withdrawn without authorisation and sent to addresses the project called attacker-controlled. b14g said so in a security update on X at 16:38 UTC the same day. It had paused the affected contracts. It said it was working with the Core team, security partners, and exchanges to trace the funds and to freeze what could be frozen. It has not said how the withdrawals were made. This page will not say it either.
b14g is a staking application on the Core blockchain, which is a different ledger from Bitcoin. The product it describes is dual staking. A bitcoin holder locks bitcoin on the Bitcoin network, on a timer, and does not send those coins to b14g. A CORE holder stakes CORE through b14g’s contracts on Core. The two sides are paired so they can share rewards. The bitcoin and the CORE are not the same asset, they do not sit in the same place, and a balance of one is not a balance of the other. See What is Bitcoin, in plain language?. See Staking is a lock and a queue, not a savings account. A reward line in an application is not a savings rate, and the application is still someone else’s software around the lock.
What happened
b14g’s scope sentence is the one that decides who was hit. Only CORE staked through b14g. Bitcoin that users had staked through the same product “remains time-locked on Bitcoin and was not affected”. A time lock means those bitcoin cannot be spent until the lock expires, and they stay on Bitcoin while they wait. The project’s claim is that the lock held. CORE on Core is a separate coin. The wrong network is still the wrong city.
The tracing in that same post put about 68 million CORE still on the Core chain, and about 9 million CORE frozen by exchange partners. Those two figures do not add up to 97 million. b14g did not say where the remainder sat. A freeze is a token stuck at an exchange. It is not a return to the staking contract, and it is not a payment to the person who staked. The 68 million still on the chain is a location. It is not a refund.
At 17:24 UTC the same day, Core DAO posted that “the Core network is secure”. Its account was that consensus, validators, and staking contracts operated normally, and that CORE staked directly with validators, or through protocols other than this one, was not affected. Core said it was helping b14g and the exchanges trace and freeze the funds, and that most of the stolen CORE remained on Core. The chain’s statement and the application’s statement are different layers. Core saying the network is intact does not put the 97 million back into b14g’s contracts. b14g saying the contracts are paused does not mean Core stopped producing blocks.
Dollar headlines are an evening multiplication, not the company’s sentence. A market print around 20:48 UTC put CORE near $0.0138, and one outlet’s arithmetic at that price put 97 million CORE near $1.34 million. Other writeups the same weekend used about $1.47 million. The price had also moved down on the day. Use the token count. The dollar figure depends on the hour, and b14g did not publish one.
b14g said it will publish a post-mortem covering the cause, the impact, and the next steps for affected users. As of the morning of 1 November, that post-mortem was not out. We will not fill the gap with a description of the withdrawal, and we will not publish the addresses the project named. Phishing will publish a lookalike.
Why it matters
If you staked CORE through b14g, that is the pile that moved. A paused contract stops further use of that application. It does not restore a withdrawal that already settled. If you locked bitcoin through b14g, the project says those coins stayed on Bitcoin under the time lock. Check that on Bitcoin, in a wallet that can show the lock, and not on a webpage that arrived on 31 October. If you staked CORE directly with a Core validator, or through a different application, Core DAO says this incident was not that stake.
The failure mode to keep distinct is the one where the bitcoin claim was the thing that broke. Liquid printed unbacked L-BTC. Nomic’s nBTC broke, and Osmosis froze allBTC. Those were vouchers that were supposed to be bitcoin and were not fully backed. b14g’s account this week is the other way around: the application’s CORE moved, and the bitcoin lock was the piece that did not. A voucher story and a token-on-another-chain story are both “not your bitcoin”. They are not the same loss.
Nobody who can restore a CORE stake needs a recovery phrase, a fresh approval, or a deposit to a new address “so the freeze can be reversed”. See A practical checklist for keeping crypto safer and How crypto wallets actually work. The same week’s other losses were a trading bot on Solana, a rollup bridge, and an EVM-side token on Humanode. Bloom’s 9,408 SOL, zkLink’s halt, and Humanode’s eHMND are those pages. None of them spent bitcoin that was time-locked on Bitcoin.
What happens next
The post-mortem b14g promised. A fuller accounting of the CORE that is not in the 68 million or the 9 million. Whatever the exchanges do with the frozen slice, which is still not a user refund until someone says so in those words. Watch b14g’s own account and Core’s. We will not treat “the Core network is secure” as “b14g users were made whole”, and we will not treat a time lock as a reason to send more bitcoin to a message.
Not a recommendation to stake, unstake, buy, or sell CORE or bitcoin. Not a finding that every bitcoin-staking application was hit. Not a description of the withdrawal. The project’s own account, on the afternoon of 31 October, was a token count, a pause, a bitcoin lock that held, and a post-mortem still to come.
