b14g confirms unauthorized withdrawal of about 97 million staked CORE

In its October 31 disclosure, b14g said it paused affected contracts upon discovery, reported an initial estimate of about 9M CORE frozen and said staked BTC was unaffected. The operator’s later timeline places the withdrawal at 09:29:51 UTC and the pause at 10:35:51 UTC, about 66 minutes later. The discovery time remains unspecified. Public copy of the October 31 disclosure.

October 31 Bitquery analysis: Bitquery reports that a wallet with no funded orders submitted 99 requests for zero CORE, emptying 91 orders. Its analysis says the downstream staking contract interprets zero as full withdrawal. This is a transaction-based finding, not a source-code audit or final vendor root cause. The researcher places the pause at 10:35:51 UTC on October 31, about 66 minutes after the drain; that does not establish when b14g discovered it. The vendor’s pause statement remains valid. Its 19:43 UTC balance snapshot is historical and cannot prove exchange freezes or repayments. The verified-fix and exit-procedure gaps remain.

November 2 affected-company disclosure: BTCS’s ESPI report 32/2026, read as an issuer-authored filing publicly republished by Bankier, says it holds about 68.3M CORE, around 90% staked through b14g. Preliminary information from the protocol operator suggests about 30% (~20M CORE) may have been lost; BTCS is verifying this. Remaining staked tokens are locked with no known withdrawal-restoration date. This is one holder’s exposure within the ~97M CORE incident, not an additive loss. The company writes down the full CORE carrying value by about PLN6.05M to zero, also citing liquidity and its exit decision. That non-cash impairment does not change token quantities and is neither a confirmed theft total nor compensation. BTCS says its own 202.27 BTC (September 30 snapshot) was unaffected and it has no Binance exposure; this does not establish safety or recovery of all b14g assets. It reported its positions to the operator; final losses and recovery arrangements remain pending.

November 6 research follow-up: SigIntZero’s bytecode reconstruction identifies a check that still allows the drain: zero passes an amount-versus-stake comparison, then requests the full downstream stake. It reports an unverified 68,146,177.22 CORE moved to recovery, not users. The Core implementation corroborates the adjustment mechanism, but code alone cannot prove execution, balances or distributions. The operator’s postmortem separately confirms the approximate fork recovery and explains the root cause.

In its November 6 postmortem, b14g confirms that the affected contracts passed zero through a public withdrawal path because it satisfied the check against the caller’s balance. The operator says a September 9, 2025 update made zero release the order contract’s entire stake with the validator. The order contract forwarded the proceeds to the caller. b14g says no keys were stolen, its contracts had not changed for 17 months and its time-locked BTC was unaffected. Its planned safeguards are local rejection of zero and other invalid amounts, integration tests when Core changes, automated withdrawal alerts and a faster pause. No fixed deployment is identified in the postmortem. Public copy of b14g’s postmortem.

b14g reports that the fork recovered about 68.15M CORE and about 12M CORE was reported frozen at exchanges. The latter includes 9.5M reported by SEAL 911 across three ChangeNOW orders without direct confirmation from ChangeNOW to b14g, and 2.5M at Bybit. The operator plans to credit approximately 70.2% of each affected order as staked balance within five to seven days of the November 6 report. The remaining repayment would use 50% of future b14g Core staking revenue, plus any funds returned from exchange freezes, through weekly claims. The report gives no claim start date or completed repayment.