Core-network staking protocol b14g posted a security update on Oct 31 saying that at 09:29 UTC approximately 97M CORE staked through b14g was withdrawn without authorization and sent to attacker-controlled addresses.

• Response: b14g paused the affected contracts and is working with the Core team, security partners and exchanges to trace, freeze and recover funds.
• Tracing so far: about 68M CORE remains on the Core chain, and exchange partners have frozen about 9M CORE linked to the attacker.
• Scope: only CORE staked through b14g is affected. BTC staked through b14g remains time-locked on Bitcoin and was not affected, according to b14g.
• Attacker addresses (as published by b14g): 0xc556ed208285406d71705927f92d4f4eaea579f1 and 0x27758c30f8e424fbd8ca605bf31e9496c26ce92c.

What to do: exchanges and bridges can add the two addresses to screening. b14g users should wait for the promised post-mortem and official next steps, and ignore any "claim" or "refund" links that don't come from b14g's own channels. The technical cause has not been published yet.