The $97M Hack That Was Worth $1.36M: b14g's 97 Million CORE Drain — and Why Your Bitcoin Was Never at Risk

The Headline Said $97 Million. The Real Number Is $1.36 Million.

On October 31, 2026, at 09:29 UTC, attackers drained approximately 97 million CORE tokens from Bitcoin staking protocol b14g. Headlines around the world quickly rounded that up into a "$97 million exploit." Here is the payoff up front: the tokens were worth roughly $1.36 million at midday prices, not $97 million. Your Bitcoin was never touched. And the difference between those two numbers tells you almost everything you need to know about how crypto headlines mislead — and how staking risk really works.

b14g paused its affected contracts within hours, exchanges froze about 9 million CORE linked to the attacker, and roughly 68 million CORE is still traceable on the Core blockchain. Bitcoin staked through b14g remained time-locked on the Bitcoin network, completely unaffected. The Core network itself kept running normally. So what actually broke, who actually lost money, and what should you check before you stake Bitcoin through any protocol? This article separates the facts from the headlines, with the numbers, the timeline, and a checklist you can use before you lock up a single satoshi.

What Happened at 09:29 UTC on October 31

b14g is a Bitcoin staking protocol that acts as a coordination layer for dual staking on the Core blockchain and Babylon. In plain terms: users stake Bitcoin, and the protocol matches that Bitcoin stake with CORE tokens to earn additional yield. It is part of the fast-growing "BTCFi" sector — protocols that try to make Bitcoin, an asset that does not natively pay yield, generate returns.

According to b14g's own security update, posted on October 31, approximately 97 million CORE tokens staked through its infrastructure were withdrawn without authorization at 09:29 UTC and transferred to attacker-controlled addresses. The project said it discovered the unauthorized withdrawals, immediately paused the affected contracts, and began working with the Core team, security partners, and exchanges to trace the funds and coordinate freezes.

b14g disclosed two attacker-controlled addresses, including 0x27758c30f8e424fbd8ca605bf31e9496c26ce92c and 0xc556ed208285406d71705927f92d4f4eaea579f1. Its preliminary tracing found about 68 million CORE still sitting on the Core network, while exchange partners had frozen roughly 9 million CORE linked to the attacker. What b14g has not yet disclosed is the technical cause of the exploit, the final dollar value of the loss, or how many users were affected. A detailed post-mortem is promised but, at the time of writing, has not been published.

The timing matters. The drain landed on the same weekend as the largest hack in crypto history — the $6.3 billion Binance theft attributed to North Korea's TraderTraitor group — which dominated every news cycle. The b14g incident was smaller, quieter, and far more misunderstood. That is exactly why it deserves a closer look.

The $97 Million Mistake: 97 Million Tokens Is Not $97 Million

This is the single most important correction in this story. Many outlets reported the exploit as a "$97 million" incident because 97 million tokens were drained. But tokens are not dollars. The value of 97 million CORE at the prices trading around midday on October 31 was approximately $1.36 million, according to BSC News' reporting of the incident. That is a gap of roughly 98.6% between the headline number and the money actually at stake.

Figure reported	What it actually means
97 million CORE drained	The number of tokens moved without authorization — real, but not a dollar figure
"$97 million exploit"	A headline error: it treats each CORE token as worth $1, which it is not
~$1.36 million	Approximate dollar value of the drained CORE at midday prices on October 31
~68 million CORE traced on Core	Tokens still visible on the Core network, not yet recovered to users
~9 million CORE frozen by exchanges	About 9% of the drained amount, blocked from moving — not the same as recovered

Why does this matter beyond pedantry? Because inflated numbers distort risk decisions. A reader who believes $97 million vanished from a Bitcoin staking protocol will reasonably conclude that Bitcoin staking is catastrophically dangerous. A reader who knows the real figure — $1.36 million in a secondary reward token, with Bitcoin itself untouched — can make a far more accurate judgment. Exaggerated loss figures also inflate fear during an already brutal month: Bitcoin is down about 39% from its $126,080 all-time high, ETF outflows are running at record pace, and sentiment sits in "Fear" at 34 on the Fear & Greed Index. In that environment, a false $97 million figure does real damage to understanding.

There is a second number that needs the same treatment. The 9 million CORE frozen by exchanges is often described as "recovered." It is not. Frozen means the tokens cannot move; it does not mean they have been returned to users, and b14g itself has been careful to say the frozen amount describes restricted movement, not a confirmed recovery total. Likewise, the 68 million CORE still on the Core network may sit in attacker-controlled wallets that are visible but inaccessible without further action. The honest summary: 97 million CORE was taken, about 9% has been frozen by exchanges, most of the rest is traceable but not yet back, and the final net loss is still unknown.

What b14g Actually Does — and Where the Risk Sat

To understand why Bitcoin survived this incident untouched, you need to understand the architecture. Bitcoin's base layer does not have smart contracts in the way Ethereum does, so "Bitcoin staking" always involves some bridge, wrapper, or coordination layer. b14g's model is dual staking: Bitcoin staked by users is time-locked on the Bitcoin network itself, and CORE tokens are staked alongside it through b14g's contracts on the Core chain to generate yield.

That design is precisely what limited the damage. The attacker compromised the CORE staking infrastructure — the contracts handling the reward token — not the Bitcoin time-locks. Bitcoin deposited through b14g stayed locked on the Bitcoin network, governed by Bitcoin's own security, not by b14g's smart contracts. This is the critical architectural distinction that most coverage skipped: the asset that was drained (CORE) and the asset users care most about (BTC) lived in different security domains.

Core DAO, which supports the Core blockchain, confirmed this publicly: the Core network's consensus, validators, and staking contracts operated normally throughout the incident, and CORE staked directly with validators or through other protocols was unaffected. The blast radius was limited to CORE staked through b14g's contracts. That is a meaningful containment success — and it is also a warning. The containment worked because of how the protocol was built, not because attackers were kind. A differently structured protocol could have put Bitcoin itself at risk.

What Most People Get Wrong About the b14g Drain

Myth 1: "$97 million in Bitcoin was stolen." False on both counts. The drained asset was CORE, not Bitcoin, and the dollar value was roughly $1.36 million, not $97 million. No Bitcoin was stolen in this incident.

Myth 2: "Bitcoin staking is broken." Misleading. What broke was one protocol's CORE staking contracts. Bitcoin's own network, and CORE staked directly on Core, were unaffected. The failure was in a specific implementation, not in the concept of staking.

Myth 3: "The frozen 9 million CORE means users got their money back." Not yet. Frozen tokens are immobilized, not returned. Recovery depends on legal process, further tracing, and b14g's post-mortem plan — none of which is complete.

Myth 4: "The Core blockchain was hacked." False. Core DAO stated its network operated normally. The exploit hit b14g's contracts, not the chain underneath them.

Myth 5: "Small protocols are safe because hackers target big ones." Dangerous. The same weekend proved the opposite: while the world watched the $6.3 billion Binance theft, a much smaller protocol was drained in parallel. Attackers do not only hunt the biggest targets; they hunt the weakest contracts, whatever the size.

Is Bitcoin Staking Safe? A Realistic Comparison

The honest answer is: it depends entirely on where your Bitcoin actually lives. Not all "Bitcoin staking" is the same product, and the b14g incident is a perfect lens for the differences.

Staking route	Where your BTC lives	What can go wrong	b14g lesson
Native Bitcoin holding (no staking)	Your own wallet, Bitcoin network	Only your own key management	Zero exposure to this incident
Direct Core staking	Core network validators	Validator or chain risk, CORE price risk	Explicitly unaffected, per Core DAO
b14g dual staking	BTC time-locked on Bitcoin; CORE in b14g contracts	Smart-contract risk on the CORE side	CORE side drained; BTC side untouched
Custodial exchange staking	On the exchange's balance sheet	Exchange hack, insolvency, withdrawal freeze	See: Binance, October 2026

The pattern is consistent across every major incident of 2026: losses concentrate where users surrender control — to an exchange, to a bridge, or to a smart contract — and the safest outcomes belong to users whose assets stayed on the base chain or in their own wallets. Yield is never free. Every percentage point of return is payment for a specific risk, and the b14g case shows that risk is often concentrated in the least-scrutinized part of the stack: not the famous asset, but the reward token and the contracts moving it.

That does not mean Bitcoin staking is something to avoid entirely. It means the question to ask is never "what is the APY?" but "what exactly am I trusting, and what happens if that piece fails?" In b14g's case, the answer turned out to be reassuring for Bitcoin holders and painful for CORE stakers. In another protocol, the answer could be reversed.

7 Checks Before You Stake Bitcoin Through Any Protocol

Use this checklist before you lock Bitcoin — or any asset — into a staking protocol. If you cannot answer a question, treat that as a reason to wait, not a detail to skip.

1. Where does my Bitcoin actually live? Time-locked on the Bitcoin network, in a multisig, in a bridge contract, or on the protocol's own balance sheet? The further it moves from the base chain, the more risk you take. If the protocol cannot explain this in one paragraph, walk away.

2. What is the yield paid in? If rewards come in a secondary token like CORE, your real return depends on that token's price — and your real risk includes that token's contracts. A headline APY in a volatile reward token is not the same as yield in Bitcoin.

3. Has the contract code been audited, and by whom? Look for named auditors, published reports, and — critically — whether the audited code is the code actually deployed. An audit of version one means little if version three is live.

4. Is there a pause mechanism, and who controls it? b14g's ability to pause affected contracts quickly limited further damage. A protocol with no pause switch, or one controlled by a single key, is a different risk profile entirely.

5. What is the withdrawal path if things go wrong? Time-locks cut both ways: they protected b14g's Bitcoin, but they also mean you cannot exit instantly. Know the unlock period before you enter, not after.

6. How big is the protocol, really? Ignore token-count headlines. Check total value locked in dollars, the number of users, and how much of the protocol's activity is real versus incentivized. Small, unaudited, high-APY protocols are where disproportionate losses happen.

7. Do you need the yield at all? Bitcoin's long-term case never depended on staking yield. If you cannot clearly explain why the extra return is worth the extra trust, holding your own keys remains the strongest position in crypto — and it is the one position the b14g incident could not touch. For the basics of doing that properly, see our guides on how to store crypto safely and how to buy Bitcoin safely after the Binance hack.

What Happens Next for b14g Users

Three things will decide the outcome, and none is resolved yet. First, the post-mortem: b14g has promised a detailed report covering the technical cause, the scope of impact, and next steps for affected users. Until that lands, every assessment of "how did this happen" is provisional, and users should treat any unofficial explanation with skepticism. Second, recovery: the frozen 9 million CORE is only a starting point. Whether the 68 million CORE still on the Core network can be returned depends on tracing, exchange cooperation, and possibly legal action — a process that in past incidents has taken months, not days, and often ends in partial recovery. Third, the precedent: this incident will shape how BTCFi protocols are audited and structured. Expect more scrutiny of dual-staking designs, and expect users to ask harder questions about where reward tokens live.

The broader context should not be lost. October 2026 was the worst month for crypto security in years: the $6.3 billion Binance theft, the b14g drain, and a wave of phishing and drainer attacks on DeFi front-ends all landed within days. Yet the pattern of survival is also consistent. Assets held in self-custody, assets locked on base chains, and assets staked directly with validators came through intact. The losses clustered exactly where control was delegated. That is the lesson to carry into November: in crypto, custody is not a detail. It is the whole game. For a reminder of why that matters even for experienced holders, read whether your hardware wallet is actually safe in 2026 — and if you are still learning the mechanics of forced selling, what a crypto liquidation really is.

Frequently Asked Questions

Was $97 million stolen from b14g? No. About 97 million CORE tokens were drained, but those tokens were worth roughly $1.36 million at prices around the time of the incident. The "$97 million" figure confuses token count with dollar value.

Was any Bitcoin stolen in the b14g exploit? No. Bitcoin staked through b14g remained time-locked on the Bitcoin network and was unaffected. Only CORE tokens staked through b14g's contracts were drained.

Is the Core blockchain safe after the incident? According to Core DAO, the network's consensus, validators, and staking contracts operated normally throughout, and CORE staked directly on the network was not involved. The exploit targeted b14g's contracts, not the chain.

Will b14g users get their CORE back? Unknown. Exchanges froze about 9 million CORE, and about 68 million CORE remains traceable on the Core network, but frozen and traced are not the same as returned. b14g's promised post-mortem should clarify the recovery plan.

Should I stop staking Bitcoin because of b14g? Not necessarily — but you should check where your Bitcoin lives, what the yield is paid in, and whether the contracts are audited before you stake. Holding your own keys remains the lowest-risk option.

How is this different from the Binance hack? Scale, asset, and target. The Binance theft was $6.3 billion, mostly Bitcoin and other major assets, from the world's largest exchange. The b14g drain was about $1.36 million in CORE from one protocol's staking contracts. Both are warnings about delegated custody, but they are not the same event.

Conclusion

The b14g drain will be remembered, if at all, as a footnote to the Binance hack weekend. It deserves better than that — not because of its size, but because of its clarity. It proved, in a single incident, that token counts are not dollar losses, that frozen is not recovered, and that the architecture of a protocol decides who loses money long before any attacker shows up. Bitcoin holders in b14g survived because their coins never left Bitcoin's security domain. CORE stakers lost because their tokens lived inside a contract that failed.

Before you chase the next staking yield, ask the one question this incident answers for you: if this protocol fails tomorrow, which of my assets are actually at risk — and are they the ones I can afford to lose? If you cannot answer that clearly, the yield is not worth it. And if the next headline screams a nine-figure loss, do what this article did: divide the token count by the price, and check what was actually taken. The truth is usually smaller, more specific — and far more useful — than the headline.

Sources: Coin Edition's report on the b14g exploit, BSC News on the paused contracts and token value, and KuCoin's flash report on the unauthorized transfer. This article is for education only and is not financial advice.