🔓 How can “0 withdrawals” drain an entire staking position?

At 09:29 UTC on October 31, 91 staking orders belonging to Bitcoin staking platform b14g on the Core chain were emptied in a single transaction by the same wallet.

📌 Key figures
• The attacker submitted 99 withdrawal requests with an amount of “0”
• A total of 97,045,563 CORE was transferred out, worth approximately $1.47 million at the time according to Bitquery’s estimate
• Cause: The Core staking contract interpreted “withdraw 0” as “withdraw everything,” while b14g did not block these zero-value requests
• The protocol did not pause the contract until about 66 minutes later
• b14g said around 68 million CORE remain on the Core chain, and exchanges froze about 9 million (the freeze data cannot be verified using on-chain data alone)

🛡️ Scope of impact
• Core DAO said the Core network’s consensus, validators, and staking contracts are operating normally, and direct staking is unaffected
• b14g said its staked BTC remains locked on the Bitcoin chain and is unaffected
• Bitquery also noted that it has not seen b14g’s source code, so it cannot identify the specific line where the error occurred

📊 Takeaways
The amount wasn’t huge, but the vulnerability was extremely basic: a single boundary value, “0,” could trigger a full payout. DeFi composability means that missing input validation in one protocol can turn an underlying contract’s “default behavior” into an attack vector. Before using staking or restaking protocols, don’t just look at the yield—check their audits and pause mechanisms too.

💬 Would you withdraw from restaking protocols because of incidents like this? Share your thoughts in the comments.

👉 Trade BTC: https://www.binance.com/zh-CN/trade/BTC_USDT

#B14g约9700万枚CORE遭未授权转移 #链上安全 #CORE #BTC #DeFi

⚠️ The above does not constitute investment advice. Please be aware of the risks.