TL;DR:
The b14g staking platform recovered 68,146,177 CORE tokens, equivalent to 70.2% of the total drained in the October 31, 2026 exploit .
The recovery was carried out via a hard fork and a coordinated single state adjustment on the Core network .
Smart contracts suffered a breach of 97.05 million CORE valued at $1.47 million due to a logical flaw in handling zero-value withdrawals.
The b14g staking protocol recovered 70% of the stolen CORE after the Core network completed a hard fork to reverse the balances held in three addresses controlled by the attacker.
https://t.co/HJS2J8KzOJ
— b14g (@b14g_network) November 6, 2026
The technical intervention was implemented following the security incident recorded on October 31, 2026, at 09:29 UTC. On that date, a malicious actor exploited a vulnerability in b14g ‘s withdrawal contracts, extracting a total of 97.05 million CORE tokens. According to on-chain records documented by Bitquery, this amount represented approximately $1.47 million at the time of the drain.
Through a single state adjustment on Core ‘s base layer, developers managed to recover 68,146,177.22 CORE that remained immobile in wallets linked to the attacker. According to b14g ‘s statement, these funds correspond exactly to 70.2% of the assets compromised during the exploit .
Failure Mechanics and Hard Fork Execution on Core
The security breach originated from a logical incompatibility between b14g ‘s smart contract and the native staking code of the Core network . According to on-chain forensic analysis reports, the attacker sent 99 withdrawal requests within a single transaction, deliberately setting the withdrawal parameter to zero (0 CORE ).
Core ‘s underlying staking system interpreted a value of zero as a request to withdraw all funds delegated with a validator. By not properly filtering or validating requests with zero input, the b14g contract moved the requests to the main layer. As a result, 91 complete staking positions were immediately liquidated, delivering the funds to a wallet that had not contributed capital to the system.
The pause of the protocol’s operational functions took about 66 minutes to be applied after the initial transaction. During that time frame, the attacker transferred approximately 23.4 million CORE to external wallets and centralized cryptocurrency exchanges.
Reports issued by the b14g team indicated that associated exchanges managed to preemptively freeze nearly 9 million additional tokens linked to the attacker’s flows. Likewise, the organization affirmed that Bitcoin ( BTC ) positions locked on the platform remained intact, due to these assets being under time-lock mechanisms directly on the Bitcoin network.
For its part, Core DAO clarified in a public statement that the network consensus, decentralized validators, and direct delegation contracts were not compromised, placing the root of the problem exclusively in the integration logic of the b14g application.
To restore assets that had not left the network, Core validators coordinated the application of the hard fork . This extraordinary administrative measure allowed reassigning balances from the attacker’s accounts to a treasury controlled by the protocol.
Current Fund Status and Compensation Plan
Despite the on-chain rescue of 68.15 million units, the funds have not yet been redistributed to end-users affected by the account draining.
The b14g development team communicated that it is in a technical phase of verifying historical balances to determine the specific impact per user. According to official information supplied through November 2, 2026, the platform has not enabled a formal claims process or external distribution links, alerting users about possible fraud attempts via unofficial channels.
Assets that were blocked by centralized exchanges have not been repatriated to the protocol’s accounts either, given that they remain subject to the legal and regulatory compliance procedures of each entity.
b14g representatives indicated that they will publish a detailed post-mortem report that will cover the complete contract audit, the schedule for the gradual reopening of operations, and the definitive scheme for the proportional restitution of assets to depositors.
