Bitcoin staking platform b14g suffered a $1.47 million exploit on Oct. 31, dropping roughly 97 million CORE tokens.
The attacker drained 91 staking positions in a single transaction by submitting withdrawal requests for zero CORE, based on an investigation by blockchain analytics agency Bitquery.
The staking platform confirmed the unauthorized withdrawals and mentioned it had paused the affected contracts whereas coordinating with the Core workforce, safety companions, and exchanges to recuperate the funds.
Nonetheless, b14g clarified that the breach was restricted to CORE deposits. Bitcoin staked via the protocol stays time-locked on the BTC blockchain and was not affected.
How hackers exploited b14g’s withdrawal mechanism
Bitquery’s investigation revealed that the attacker exploited a weak point within the interplay between b14g’s withdrawal mechanism and Core’s staking contracts.
Below regular circumstances, b14g permits Bitcoin holders to pair their BTC with CORE deposits to earn enhanced staking rewards. The protocol manages these preparations via staking positions that maintain CORE and delegate it to validators.
Nonetheless, Core’s staking contract incorporates an uncommon provision that interprets a withdrawal request for zero tokens as an instruction to withdraw all the staked stability.
The attacker exploited this conduct by submitting 99 zero-value withdrawal requests towards staking positions it had not funded.
Moderately than rejecting the unauthorized requests, b14g’s contract accepted them and handed the directions to Core’s staking system, which launched roughly 97 million tokens.
Bitquery mentioned the exploit occurred at 09:29 UTC, with the stolen tokens transferred to an attacker-controlled pockets.
The investigation discovered no proof that the attacker wanted a compromised administrator key or a newly deployed malicious contract. As a substitute, the underlying contract logic had reportedly been in place for about 17 months.
Nonetheless, Bitquery cautioned that it had not reviewed b14g’s underlying supply code and couldn’t establish the exact programming error that allowed the unauthorized withdrawals.
In the meantime, blockchain information confirmed that b14g didn’t pause the affected contracts till 10:35 UTC, roughly 66 minutes after the preliminary assault.
Throughout that interval, the attacker transferred 23 million CORE from the unique pockets via a number of newly created addresses.
The timeline doesn’t set up when b14g found the breach, though the platform mentioned it paused the contracts instantly after figuring out the incident.
Additional tracing revealed that some stolen funds moved via middleman addresses related to change infrastructure related to Bybit, Gate.io, and MEXC.
Bitquery additionally recognized a service that equipped the attacker’s preliminary transaction charges, then obtained about 11 million CORE from the stolen funds and forwarded them to an MEXC deposit deal with.
Nonetheless, the analytics agency cautioned that some middleman wallets additionally dealt with different clients’ property, making it tough to attribute each subsequent switch on to the attacker.
By the night of Oct. 31, roughly 68 million CORE, representing 70% of the stolen tokens, had remained unmoved in three wallets.
Individually, b14g reported that change companions had frozen roughly 9 million CORE linked to the attacker.
In its response, Core DAO maintained that the underlying blockchain had not been compromised, stressing that its consensus mechanism, validators, and staking contracts continued working usually all through the incident.
It additionally mentioned CORE staked immediately with validators or via different protocols remained unaffected.
b14g has pledged to publish an in depth autopsy explaining the technical explanation for the exploit, the extent of consumer losses, and the subsequent steps for affected depositors. The platform has not but disclosed a compensation plan.
