A hacker stole $1.47 million from Bitcoin staking platform b14g by submitting withdrawal requests for exactly zero tokens, and the protocol paid out anyway.
On October 31, an attacker exploited a critical validation flaw in b14g's smart contracts, draining 91 separate staking positions in a single transaction. The haul: approximately 97 million CORE tokens, gone before the platform knew what hit it. Blockchain analytics firm Bitquery confirmed the mechanics of the attack, and b14g has since acknowledged the unauthorized withdrawals.
Let that sink in. The exploit did not require sophisticated code, a flash loan, or a multimillion-dollar setup. The attacker simply asked for nothing, and the protocol handed over everything.
The Zero-Token Exploit Nobody Predicted
This class of vulnerability, sometimes called a zero-value input bug, targets contracts that skip input validation before processing withdrawal logic. When b14g's contract received a request to withdraw zero CORE, it apparently skipped the sanity check, executed the withdrawal function anyway, and drained the underlying staked balance tied to the position.
Multiplied across 91 positions in one transaction, that oversight became a $1.47 million disaster.
Bitquery's on-chain trace shows the attacker moved efficiently, suggesting the exploit was planned and tested before execution. The timing, Halloween, ensured lower monitoring activity across many protocol teams.
Why This Hits Different for Bitcoin Staking
Bitcoin staking is one of the fastest-growing narratives in crypto right now. Protocols like Babylon and its ecosystem partners, including CORE-based platforms, are racing to capture yield-hungry BTC holders who want returns without bridging off Bitcoin. b14g sits inside that ecosystem, and this exploit is a direct hit on confidence in the sector.
Users who deposited CORE to earn staking rewards are now staring at positions that may not be made whole. b14g has not yet announced a recovery plan or compensation mechanism as of this writing.
What Traders and Stakers Need to Watch
If you are currently staking on any smaller Bitcoin-adjacent protocol, this is your signal to audit where your funds sit. The b14g exploit was not a sophisticated attack. It was a basic input validation failure, which means similar vulnerabilities could be sitting undetected in competing platforms built under the same speed-to-market pressure.
Watch for CORE token price reaction as confidence in the ecosystem gets stress-tested. Watch for Babylon or major auditors to respond publicly, which could either reassure the market or accelerate withdrawals from similar platforms.
The zero-token trick cost b14g $1.47 million. Do not let it cost you too.