Bitcoin staking platform b14g lost about 97 million CORE tokens, valued by Bitquery at $1.47 million, on 31 October, CryptoSlate reports. The attacker submitted zero-value withdrawal requests, which Core's staking contract treats as a request to withdraw the entire balance, and emptied 91 positions in one transaction. b14g paused the contracts about 66 minutes after the attack and says users' bitcoin, time-locked on the Bitcoin network, was not affected. Partner exchanges have frozen about 9 million CORE.

What it means: The attack needed no stolen keys and no new malicious contract. It exploited a mismatch between two pieces of code that had worked together for about 17 months: one did not reject requests for positions the caller did not own, and the other gave zero the meaning of everything. Composition bugs like this are among the hardest to catch in audits, because each piece looks correct on its own. The amount is small compared with the big incidents of the week, but the case shows the risk in products promising extra yield on bitcoin through other chains and tokens. The user's bitcoin stays safe, yet they are exposed to all the risks of the second leg. For anyone in Greece assessing such services, useful questions are who audited the contracts, whether the audit covered interaction with external protocols, and how quickly the team can pause operations. The 66-minute delay here let the attacker move part of the funds before anyone stepped in.

Read the original on CryptoSlate

Related service: Consulting

Related stories