b14g Accounts for $2.81 Million of Core Blockchain's DEFI TVL After 97 Million CORE Exploit

b14g (@b14g_network), a Bitcoin dual-staking protocol, accounts for most of the DeFi activity on the @Coredao_Org blockchain, according to DefiLlama data. The protocol is also at the centre of a recent exploit that tested the network's response to a security incident.

b14g Dominates Core's DeFi Activity

DefiLlama lists b14g with $2.81 million in TVL on Core. The same page put Core's total DeFi TVL at about $3.28 million as of 1 November, which means b14g represents the bulk of value locked on the chain.

b14g's wider footprint is larger. DefiLlama classifies it as a restaking protocol and shows total TVL of about $312 million across chains, with most of it on Bitcoin and a smaller portion on Core. The protocol describes itself as a modular dual-staking layer that lets networks secure themselves with both $BTC and their native token.

On Core, dual staking lets users combine staked $BTC with staked $CORE to unlock higher reward tiers. b14g's documentation says its Merge Marketplace matches $BTC holders with CORE holders so that users do not need to deposit both assets themselves. The boosted rewards are split between the two sides. Because $BTC staked through b14g stays time-locked on the Bitcoin network, the protocol channels Bitcoin capital into securing Core without moving the coins.

October Exploit and Hard Fork Recovery

b14g is not risk-free. At 09:29 UTC on 31 October, about 97 million CORE staked through the protocol was withdrawn without authorisation, according to TokenPost. b14g paused the affected contracts, and said $BTC staked through the protocol was unaffected. Core DAO said the network itself was not compromised and that CORE staked directly with validators or through other protocols was not affected.

Core then carried out a hard fork. According to The Defiant, the fork moved 68.15 million CORE into a recovery address, covering about 70% of the affected tokens. b14g described it as a one-time state adjustment that did not reverse transactions, mint new tokens or change the total supply.

Recovery is incomplete. The recovered tokens had not been distributed to users and no claims process was open at the time of reporting. Exchange partners also froze around 9 million CORE, which had not been returned. The Defiant estimated that roughly 19.9 million CORE sat outside both the fork recovery and the reported freezes, while noting the figure is a provisional reconciliation and not a confirmed permanent loss.

The incident shows the trade-off in concentrated ecosystems. A single protocol supplies most of Core's DeFi TVL and a large share of its dual-staking flow, so a flaw in that protocol reaches well beyond its own users.