---
title: b14g says about 97 million staked CORE was withdrawn without authorization; contracts paused, 9M frozen by exchanges | ctxsec
url: https://ctxsec.com/items/b14g-97m-core-unauthorized-withdrawal-contracts-paused
description: "Bitcoin staking protocol b14g said that at 09:29 UTC on Oct 31 about 97M CORE staked through it was withdrawn without authorization to attacker-controlled addresses. It paused the affected contracts, says about 68M CORE is still on the Core chain and exchanges have frozen about 9M, and says BTC staked through b14g stayed time-locked on Bitcoin. A post-mortem with the technical cause is promised."
status: "official (b14g on X, Oct 31); cause not yet published"
published: 2026-10-31
---

> Bitcoin staking protocol b14g said that at 09:29 UTC on Oct 31 about 97M CORE staked through it was withdrawn without authorization to attacker-controlled addresses. It paused the affected contracts, says about 68M CORE is still on the Core chain and exchanges have frozen about 9M, and says BTC staked through b14g stayed time-locked on Bitcoin. A post-mortem with the technical cause is promised.

[← Cybersecurity News](/news) · [markdown](/items/b14g-97m-core-unauthorized-withdrawal-contracts-paused.md)

official (b14g on X, Oct 31); cause not yet published

2026-10-31

### b14g says about 97 million staked CORE was withdrawn without authorization; contracts paused, 9M frozen by exchanges

Core-network staking protocol **b14g** posted a security update on **Oct 31** saying that at **09:29 UTC** approximately **97M CORE** staked through b14g was withdrawn without authorization and sent to attacker-controlled addresses.

- **Response:** b14g paused the affected contracts and is working with the Core team, security partners and exchanges to trace, freeze and recover funds.
- **Tracing so far:** about 68M CORE remains on the Core chain, and exchange partners have frozen about 9M CORE linked to the attacker.
- **Scope:** only CORE staked through b14g is affected. BTC staked through b14g remains time-locked on Bitcoin and was not affected, according to b14g.
- **Attacker addresses** (as published by b14g): `0xc556ed208285406d71705927f92d4f4eaea579f1` and `0x27758c30f8e424fbd8ca605bf31e9496c26ce92c`.

**What to do:** exchanges and bridges can add the two addresses to screening. b14g users should wait for the promised post-mortem and official next steps, and ignore any "claim" or "refund" links that don't come from b14g's own channels. The technical cause has not been published yet.

Sources: [b14g on X: Security Update (Oct 31)](https://x.com/b14g_network/status/2116570456245596580)