b14g paused its affected staking contracts at 10:35 UTC on October 31, 2026, approximately 66 minutes after the initial exploit occurred.

Overview Debates Related claims Topics Sources

An October 13, 2026 ChainSecurity report found EIP-8037 and EIP-8038 break smart contracts when external calls fail, tied to eight smart contract invariants

Ethereum core developers delayed the implementation of the Glamsterdam upgrade on the Hoodi testnet until security concerns involving eight smart contract invariants are resolved

The Ethereum Foundation stated on November 6, 2026 that EIP-8037 and EIP-8038 change how gas is charged for certain operations

Frax Finance reported on November 5, 2026, that its smart contracts and user assets remained secure despite LayerZero's temporary cross-chain route suspensions

An attacker drained 91 staking positions in a single transaction on October 31, 2026, by submitting 99 zero-value withdrawal requests against unbacked staking positions on b14g.

The contract logic exploited in the October 31, 2026 b14g breach had been active for approximately 17 months prior to the incident without requiring administrator key compromises.

Core's underlying staking contract contains logic that interprets a withdrawal request for zero tokens as an instruction to release the entire staked balance of a position.

The Security Council temporarily modified Arbitrum's Inbox contract using a function called sendUnsignedTransactionOverride to process transactions as if sent by the Binance exploiter's address, before restoring the original contract code

Arbitrum's Security Council initiated the transfer of Binance exploit funds by calling the UpgradeExecutor contract through its Safe wallet in Ethereum block 26301886

Security firm Zealynx noted that blockchain rules requiring a private key to authorize transfers hold true only up to whoever controls the protocol's upgrade path

The unauthorized transactions from Mercado Bitcoin on November 2, 2026 were plain transfers signed as authorized transactions rather than a smart contract exploit, according to Hypernative

In October 2023, users of Telegram trading bots Maestro and Unibot lost a combined $1.1 million to smart contract router exploits.

Under TJAR's market structure, applications deposit collected fees into a Token Jar contract, allowing third-party searchers to compete to convert the assets by fulfilling requested target payouts via a Releaser contract.

Developers can deploy a Token Jar in a single transaction to configure payment tokens, pricing parameters, and destination addresses, with options to modify or permanently lock settings.

Curve Finance rebuilt its StableSwap protocol using Stellar's Soroban smart contract platform while preserving its underlying pricing mathematics.

Under Peer's trading mechanism, USDC sellers deposit tokens into an onchain smart contract escrow on the Base network prior to transaction completion.

Peer's trade process releases escrowed USDC to a buyer's wallet upon verification of direct Alipay yuan transfer or returns funds after a 6-hour order window expires.

ChainSecurity disclosed on October 22, 2026, that it had identified 13 real-world deployed mainnet contracts vulnerable to gas-accounting changes under Glamsterdam.

The attacker repeated an exploit loop 42 times by sending NEM tokens to the pool, calling skim() to extract excess tokens, and triggering flushLpSellRecycle().

ChainSecurity stated it is conducting responsible disclosure with the 13 affected projects while declining to publicly identify specific contracts.