A single transaction drained 91 staking positions, exposing a weakness that had potentially existed for 17 months.

Bitcoin staking platform b14g suffered a $1.47 million exploit on Oct. 31, losing approximately 97 million CORE tokens.

The attacker drained 91 staking positions in a single transaction by submitting withdrawal requests for zero CORE, according to an investigation by blockchain analytics firm Bitquery.

The staking platform confirmed the unauthorized withdrawals and said it had paused the affected contracts while coordinating with the Core team, security partners, and exchanges to recover the funds.

However, b14g clarified that the breach was limited to CORE deposits. Bitcoin staked through the protocol remains time-locked on the BTC blockchain and was not affected.

Bitquery's investigation revealed that the attacker exploited a weakness in the interaction between b14g's withdrawal mechanism and Core's staking contracts.

Under normal circumstances, b14g allows Bitcoin holders to pair their BTC with CORE deposits to earn enhanced staking rewards. The protocol manages these arrangements through staking positions that hold CORE and delegate it to validators.

However, Core's staking contract contains an unusual provision that interprets a withdrawal request for zero tokens as an instruction to withdraw the entire staked balance.

The attacker exploited this behavior by submitting 99 zero-value withdrawal requests against staking positions it had not funded.

Rather than rejecting the unauthorized requests, b14g's contract accepted them and passed the instructions to Core's staking system, which released approximately 97 million tokens.

Bitquery said the exploit occurred at 09:29 UTC, with the stolen tokens transferred to an attacker-controlled wallet.

Source link