Came across b14g’s incident postmortem: On October 31, Bitcoin’s dual-staking protocol was drained of about 97.05 million CORE—the attacker bypassed validation by requesting a withdrawal of “0,” then made 99 withdrawals in a single transaction, emptying 91 staking orders.
The good news is that a hard fork on the Core network on November 2 moved about 68.15 million CORE (roughly 70%) still in the attacker’s address back to a recovery address. The team says affected orders will first receive refunds at roughly 70% within 5–7 days; the remaining shortfall will be made up weekly using 50% of future Core staking revenue. Any funds recovered from the portion frozen by exchanges will also be added.
The contract hadn’t been changed in 17 months, and no private keys were lost—the integration with the Core staking contract upgrade failed to block zero-amount withdrawals. The BTC dual-staking side was unaffected. Public blockchains changing the ledger is always controversial, but this time the figures and refund schedule have both been laid out.
$CORE #b14g #Security
The good news is that a hard fork on the Core network on November 2 moved about 68.15 million CORE (roughly 70%) still in the attacker’s address back to a recovery address. The team says affected orders will first receive refunds at roughly 70% within 5–7 days; the remaining shortfall will be made up weekly using 50% of future Core staking revenue. Any funds recovered from the portion frozen by exchanges will also be added.
The contract hadn’t been changed in 17 months, and no private keys were lost—the integration with the Core staking contract upgrade failed to block zero-amount withdrawals. The BTC dual-staking side was unaffected. Public blockchains changing the ledger is always controversial, but this time the figures and refund schedule have both been laid out.
$CORE #b14g #Security
