Bitcoin dual-staking protocol B14g said about 97 million CORE staked through its platform were withdrawn without authorization at 09:29 UTC on October 31 and sent to an attacker-controlled address. According to ChainCatcher, B14g paused the affected contracts after discovering the incident. The project is investigating with the Core team, security partners, and exchanges, while tracking the funds and coordinating efforts to freeze and recover them. About 68 million CORE remain on the Core network, and exchange partners have frozen about 9 million CORE linked to the attacker. The incident affected CORE staked through B14g; BTC staked through the protocol remains time-locked on the Bitcoin network and was not affected. B14g said its priority is protecting users and recovering the affected funds, and that it will publish a post-incident report covering the technical cause, scope, and plans for affected users. The project disclosed two attacker addresses: 0xc556ed208285406d71705927f92d4f4eaea579f1 and 0x27758c30f8e424fbd8ca605bf31e9496c26ce92c. B14g describes itself as a BTCFi coordination layer that provides dual-staking matching for Core and Babylon.
