Around 17:29 on October 31, an abnormal change in pledged assets broke the normality of b14g: approximately 97 million CORE coins pledged through b14g were withdrawn en masse without authorization and swiftly transferred to an address controlled by the attacker. The assets that were supposed to be quietly locked in the yield contract transformed within minutes from a tool for "earning yields for users" into an unresolved risk exposure. b14g immediately acknowledged that a security incident had occurred, urgently paused the affected contracts, attempted to block further withdrawals of CORE, and collaborated with the Core team, security partners, and multiple exchanges to respond around tracking, freezing, and recovering processes. This sudden incident exposed the design of double pledging—intended to "add a layer of yield"—to scrutiny regarding permission and custodial structures, while also pushing the subsequent contest toward a tug-of-war between on-chain and centralized platforms: the race against time between the attacker and the recovery parties, the responsibility for user losses and potential compensation, and the industry's revaluation of the safety boundaries of this type of staking model all became pivotal issues surrounding b14g.
Moment of Attack: 97 Million CORE Withdrawn En Masse
The timeline is locked around 17:29 on October 31. According to a single source, an abnormal flow of CORE, which was originally staked on b14g, occurred at that moment: approximately 97 million coins pledged through the protocol were extracted en masse from the staking end within a very short time window, with the fund path pointing directly from b14g's staking structure to an attacker-controlled address. For on-chain observers, this manifested as b14g's related contract balances being suddenly drained, with large amounts of CORE flowing out in unison, and the transaction initiator not being a decentralized address typical of normal user interactions, but instead pointing to a recipient with single control.
According to public materials, the extracted CORE subsequently all entered the attacker-controlled address; specific address information has not been disclosed in external updates, and the identity of the attacker also remains unknown. At this stage, the outside world can only reconstruct the incident based on the set of on-chain anchors: "around 17:29, approximately 97 million CORE, concentrated transfer to a single control address." As for whether this moment was due to a breach of contract logic or misuse of private keys or permissions, b14g has not provided a technical explanation. From the outcome, this concentrated withdrawal directly tore a key gap in the b14g staking asset pool on-chain, serving as the starting point for all subsequent discussions around abnormal freezes, recovery paths, and responsibility boundaries.
b14g Emergency Brake: One-Click Contract Pause for Self-Rescue
After the abnormal concentrated outflow was detected, the b14g team quickly confirmed through official channels that this was a security incident and issued the first round of updates. With the attack path still unclear, the most direct action was to "hit the brakes"—b14g stated that it had immediately paused the affected related contracts to prevent more CORE staked in the protocol from being withdrawn. This meant that the core interactions around the stolen asset pool were paused with the push of a button, shifting the protocol from continuing operations to a priority emergency state to stop the bleeding.
After the bleeding was halted, tracking and freezing attempts began in parallel. b14g stated that it was working with the Core team, security partners, and multiple exchanges to gradually sort out the on-chain direction of the withdrawn CORE, and on platforms that could be reached, it attempted to coordinate freezing and recovery. Currently, media reports primarily provide a procedural description of this "coordinated freezing and recovery": who is participating, what is being done, rather than how much has been frozen or how much has been recovered. In terms of publicly available information, readers are now seeing the framework of emergency response itself; how effective this framework will ultimately be in recovering losses remains an unresolved key issue.
The Trust Gap in Double Pledging: Heavy Costs Once Permissions Are Lost
From a model perspective, a bitcoin double staking protocol like b14g essentially operates by placing one asset into two sets of rules: users first stake CORE through the protocol to earn yields, and then layer additional yield or functionality in Bitcoin scenarios. To allow the same asset to be "recognized" as the same collateral in different environments, double pledging often requires multiple layers of contracts or custodial relationships to coordinate, meaning a complete set of trust assumptions must be introduced between on-chain and off-chain, protocol logic and operational authority—who can see the assets, who can use the assets, and under what conditions actions can bypass the user-initiated operations.
Once multiple pledging and inter-party coordination are pieced together, the vulnerabilities in permission design and contract management are no longer abstract risks. In this incident, the pledged CORE managed by b14g was still concentrated and withdrawn without authorization in a centralized monitoring environment, indicating that if a single highly-privileged control point is breached within this structure, other monitoring and coordination mechanisms are insufficient to prevent the overall removal of assets. Public information has not disclosed the specific type of vulnerability, making it impossible to confirm whether the issue lies with the contract itself, private key leakage, or permission misuse, but what can be confirmed is that double pledging concentrates more power and trust in a few key roles and contract combinations, and this structural arrangement magnifies the systemic risk that "once permissions are lost, the cost is extremely heavy," which is the core issue that this incident has revealed.
97 Million Withdrawn and 68 Million Held: Recovery Boundaries Emerging
Numerically, the asset landscape of this incident has been roughly outlined: according to a single source, approximately 97 million CORE pledged through b14g have been withdrawn en masse without authorization and transferred into a space controlled by the attacker; this portion can be viewed as a "loss of direct control out of the protocol." In contrast, the same source also mentioned that approximately 68 million CORE remain at related addresses or platforms, sounding as if there is still "leeway" available for tracking and handling, but the original information cuts off here, as it neither specifies the exact addresses or business ports where these assets are located, nor clarifies whether they are currently effectively controlled, awaiting return, or still at risk of further transfer.
Thus, the boundary for recovery is stuck at this vague status of 68 million coins. b14g claimed that it is collaborating with the Core team, security partners, and multiple exchanges to freeze and recover, indicating that the protocol has regarded risk control coordination with exchanges and on-chain monitoring with security teams as the only realistically feasible "counterattack path." However, as long as current public information remains at the level of procedural descriptions, without any clearly frozen or recovered numbers, it is difficult to assert that recovery has achieved substantial results, nor can we rashly regard all 68 million as "safe assets." In the absence of complete information, what can be confirmed is that tracking, freezing, and recovering will be a long and uncertain contest, and the true losses users face and the potential for recovery still require more transparent on-chain and business data to ultimately draw clear boundaries.
High-Pressure Period of Security Incidents: The b14g Case is Just One of Many Alarms
Viewing b14g as an isolated hacker story is dangerous. During the same high-pressure security period, the DeFi protocol Troves' vault was attacked, with preliminary losses of about 8.6 BTC; earlier, Binance faced more than 6 billion dollars in theft, with the FBI publicly pointing to North Korean hackers, while Binance claimed to have covered about 6 billion dollars of losses. Subsequently, Trump stated that if North Korea is indeed behind it, the U.S. will seek communication with them. Meanwhile, the crypto industry has invested over 200 million dollars in political engagements around mid-term elections, and security incidents have begun to be included in broader regulatory and compliance discussions. Against this backdrop, the unauthorized concentrated withdrawal of approximately 97 million CORE from b14g is not just an incident of a single protocol, but rather a stress test of complex structures like "double pledging" under the dual pressure of regulation and attackers. The variables worth tracking next are whether the disposal and recovery plans provided by b14g, in cooperation with the Core team and exchanges, can be clearly implemented, how user losses are determined, and how compensation responsibilities are assigned, as well as whether the industry is willing to admit and review the boundaries of permissions and risk transmission mechanisms in the double pledging model and provide more prudent design answers in the new round of security and regulatory contests.
Join our community and let's discuss and grow stronger together!
Exclusive Hyperliquid benefits for AiCoin: https://app.hyperliquid.xyz/join/AICOIN88
Exclusive Aster benefits for AiCoin: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
