Bitquery Finds Zero-Value Withdrawal Attack Drained 97M CORE

Bitquery Reports Zero-Value Withdrawal Requests Drained About 97M CORE

b14g said the unauthorized withdrawal of approximately 97 million CORE tokens occurred at 5:29 a.m. ET on Oct. 31. The protocol moved quickly to pause the contracts affected by the incident, framing its response as containment rather than recovery. For related coverage, see Titan Exchange Airdrop & Testnet Positioning Playbook (October 2026).

Bitquery’s analysis identified the reported method as zero-value withdrawal requests, a transaction pattern in which requests carry no token value on their face but interact with staking contract logic in a way that releases underlying balances. According to reports citing Bitquery, 99 such requests were used to empty 91 staking positions in a single transaction. Those specific figures, including the request count and position count, have not been independently confirmed from a directly reviewed block explorer entry or official post-mortem. Context on this theme: Cyber Revolution Summit – Singapore 2026.

At the time of retrieval, CORE traded at $0.0137969, with a 24-hour decline of roughly 0.39% and a market capitalization near $20.7 million. At that price, 97 million CORE represents a token-denominated loss rather than a nine-figure dollar loss; the distinction matters for evaluating the incident’s market impact. More on this in Solana Mobile Warns Fake SKR Claim App Reached Store Spotlight.

How the Reported Zero-Value Withdrawal Request Method Was Used

Reported transaction pattern

Zero-value withdrawal requests are a known smart contract interaction pattern where a caller submits a withdrawal without specifying a token amount, or specifies zero, and the contract’s internal accounting logic resolves the final transfer incorrectly. In b14g’s case, the reported pattern involved submitting batched requests that collectively resolved against 91 open staking positions. The exploit type has appeared in other staking and yield protocols, and the broader pattern of staking contract vulnerabilities being exploited for large token drains has drawn increased scrutiny across the DeFi space.

According to a single source citing Bitquery findings, the affected contract logic had reportedly been exposed for 17 months before the Oct. 31 incident. That claim has not been confirmed by a fetched auditor finding, source-code analysis, or b14g’s own post-mortem, and should be treated as unverified.

What remains unconfirmed

No transaction hash, block explorer entry, or official Bitquery report link was directly available for review in the evidence set for this article. The CryptoSlate report that cited the 99-request and 91-position figures was blocked by an anti-bot challenge during research. That means the mechanical details of the exploit, including how the zero-value requests bypassed input validation, the specific contract functions called, and whether the positions were held by a single operator or multiple users, remain unverified at time of publication.

What Is Known About the Affected b14g Staking Positions

b14g confirmed three containment figures after pausing the affected contracts. First, exchange partners had frozen about 9 million CORE linked to the attacker, representing roughly 9.3% of the reported withdrawal amount.

Second, b14g said approximately 68 million CORE remained on Core after the incident, suggesting a portion of the broader protocol balance was not directly accessible to the attacker. Third, and notably, BTC that users had staked through b14g’s Bitcoin-native staking feature remained time-locked on Bitcoin and was not affected by the exploit, a significant caveat given that Bitcoin staking was the protocol’s primary value proposition.

The protocol’s architecture separates CORE token staking from BTC time-locking, which meant the attacker’s access was limited to the CORE-denominated staking contracts rather than the Bitcoin layer. That structural separation likely prevented a more severe outcome for users who had staked BTC through b14g’s platform. Protocols building hybrid staking and yield products have generally faced scrutiny over how contract-layer risks are isolated from underlying asset custody.

Details still awaiting confirmation

Several material questions about the b14g incident remain open. The identity and location of the attacker have not been disclosed. It is not known whether the 91 affected staking positions belonged to institutional operators, retail users, or a combination. No recovery timeline or compensation plan for affected stakers has been published in the sourced materials. The root cause, specifically whether the zero-value withdrawal pattern exploited a logic flaw, a missing input check, or a reentrancy condition, has not been confirmed in a directly reviewed post-mortem.

The broad Crypto Fear & Greed Index sat at 34, a “Fear” reading, at the time of the incident, a backdrop that tends to amplify negative protocol news in social sentiment even when the technical scope is bounded. Whether b14g intends to resume contract operations, conduct a public audit, or issue further disclosure has not been stated in the available sourced materials.

The incident adds to a string of staking-contract exploits in 2026 in which relatively obscure token pools have been drained through batched or malformed withdrawal calls, a pattern that security researchers have flagged as underexamined compared to flash-loan and bridge attacks. How b14g proceeds with its post-mortem and whether Core DAO issues any coordinated response will shape whether user confidence in the protocol’s Bitcoin staking layer, which was not directly affected, holds in the weeks ahead. Coverage of emerging security frameworks for DeFi protocols has underscored the persistent gap between audit coverage and live contract behavior.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.