The attacker behind the October 31, 2026 b14g exploit exploited b14g by submitting 99 zero-value withdrawal requests against unfunded staking positions, which Core's staking contract interpreted as instructions to withdraw entire balances