Ninety-Seven Million CORE Gone in Zero-Token Withdrawals: Inside the b14g Hack
A Bitcoin staking platform called b14g has become the latest reminder that the most dangerous exploits are often the quietest. Unknown attackers drained approximately 97 million CORE from the platform using a technique that security researchers describe as zero-token withdrawals, a method that slips past the most common alarm systems because every individual transaction looks like nothing happened at all.
For a market already on edge after the record 6.3 billion USD Binance hack, the b14g incident is smaller in dollar terms but in some ways more instructive. It shows how a clever attacker can extract value from a staking protocol without ever triggering the loud, obvious signals that exchanges and bridges have learned to watch for.
How a Zero-Token Withdrawal Works
The trick sounds almost paradoxical: the attacker requests withdrawals that transfer zero tokens on the surface while manipulating the protocol’s internal accounting underneath. Rather than grabbing a large balance in one dramatic sweep, the attacker repeatedly invoked withdrawal logic in a way that inflated credits or double-counted entitlements. Each call, viewed in isolation, appeared to move nothing. Viewed in aggregate, the calls systematically pulled roughly 97 million CORE out of the platform’s reserves.
Monitoring systems are typically tuned to catch large transfers, unusual approvals, or abrupt drops in total value locked. A stream of nominally empty withdrawals defeats those heuristics. By the time the anomaly was visible in the platform’s reserves, the extraction was done. It is the same class of logic bug that has haunted DeFi for years, where the contract’s bookkeeping and the token movements it authorizes stop telling the same story.
Why Bitcoin Staking Platforms Are in the Crosshairs
b14g sits in the fast-growing corner of crypto where Bitcoin holders seek yield. Platforms in this niche take BTC or BTC-linked assets, stake or deploy them somewhere they can earn, and pass returns back to users. The model has attracted billions in deposits because the demand is real: Bitcoin holders watched Ethereum and Solana stakers earn for years and want the same.
But every added layer is added risk. Users deposit into a platform, the platform wraps assets into a bridge or staking representation, and a separate chain’s smart contracts manage the accounting. CORE, the token at the center of this incident, powers one such ecosystem. When any link in that chain mishandles state, the whole structure is only as safe as its buggiest contract. Analysts estimate that only a small fraction of Bitcoin’s supply is put to work in yield strategies today, which means the sector’s security practices are still maturing while the stakes keep climbing.
The Pattern Crypto Investors Should Recognize
The b14g drain fits a pattern that has repeated across 2026. In October alone, a trading bot’s dormant wallets were drained in seconds, a dozen DeFi websites were hijacked through a single domain registrar, and an options protocol lost millions to a flash-loan-style governance attack. Weeks earlier, a DeFi automation platform was emptied through similar logic abuse. The common thread is not broken cryptography. It is business logic, the assumptions contracts make about how they will be called.
Attackers have learned that the perimeter is hardened, so they attack the plumbing. For everyday investors, this changes what due diligence means. A platform’s audits matter, but so do its withdrawal mechanics, its monitoring, and how quickly it can pause. The protocols that survived this year’s attacks best were the ones that froze within minutes, not the ones that promised they could never be hacked.
What Comes Next for b14g Users
Following the discovery, the platform’s immediate priorities are the standard playbook: pause withdrawals, assess the full scope of the loss, trace where the stolen CORE moved, and negotiate with exchanges to freeze any funds that reach centralized venues. Investigators have become markedly faster at this in recent months, aided by blockchain analytics firms that trace hacker wallets in near real time. Whether any meaningful share of the 97 million CORE can be recovered will depend on how quickly the attacker tries to convert it into liquidity.
Users should be skeptical of unsolicited messages claiming to offer reimbursement or migration help, as fake recovery scams reliably follow real hacks. Official announcements will come through the platform’s verified channels, not direct messages.
The Bottom Line
The b14g hack did not make headlines on the scale of Binance’s record breach, but for anyone holding assets on a staking platform it is the more relevant lesson. The biggest losses this year came not from broken keys but from clever abuse of ordinary contract logic, executed in ways designed to look boring. Size your exposure accordingly, prefer platforms with demonstrated incident response, and remember that yield is never free. Sometimes the fee is hidden in the risk you did not price.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Crypto investments carry risk; always do your own research.
Zero-token withdrawals are such a nasty design flaw. Every call looks like a no-op to monitoring so the alarm never fires while internal accounting gets inflated underneath. 97 million CORE walked out politely.
Right, dashboards trained on transfer volume were useless here. Whoever wrote that withdrawal logic never considered repeated zero amount invocations mutating balances. After the 6.3 billion Binance week this barely made headlines.
the binance week burying this story is its own lesson. anything under nine figures is a tuesday now, accountability shrinks with the noise floor
exactly, the timing buried it. 97 million core drained through withdrawal calls that moved zero tokens and it got maybe one news cycle
walked out politely is painfully accurate. monitoring dedupes no-op looking calls so the inflated credits just pile up in the background until someone reconciles
First thing I check on any staking platform now is whether withdrawal accounting and token movement are separate code paths. b14g proved the gap between them is exactly where the money goes.
zero-token withdrawals are genuinely nightmarish. every tx reads as a no-op so 97 million core walked out the door with alarms silent
Exactly. The monitoring tools watch for large transfers, and this attack never made a single obvious one. State manipulation flies under all of it.
worse, a manual reviewer would have skipped these too. zero amount txs get filtered as noise by humans and dashboards alike
never heard of b14g before today and that alone tells you everything about staking on random btc platforms
same, had to look up b14g mid article. random btc staking platforms holding nine figures with zero name recognition is exactly how the quiet ones stay quiet for months
Binance at 6.3 billion, now this. The dollar amount is smaller but the technique is the part worth studying.
The detail that repeated zero amount calls inflated internal credits is maddening. Withdrawal logic and balance updates living in separate code paths reads fine in review right up until 97 million CORE walks out.
an invariant check would have caught this, assert balances only move when tokens move. basic stuff that ships after the 97 million reminder instead of before