{"investigation":{"slug":"b-network-bsquared-bitcoin-layer-2-staking-contract-exploit","entity_name":"B² Network (BSquared) — Bitcoin Layer-2 Staking Contract Exploit","trust_score":30,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"In July 2026, BSquared Network (B²), a Bitcoin layer-2 project, suffered an exploit in which an attacker gained unauthorized access to the upgrade authority of its B2 token staking contract on BNB Chain, draining approximately 8.591 million B2 tokens worth about $3.86 million. The project suspended staking, pledged full compensation to affected users, and offered the attacker leniency in exchange for returning 10% of the funds. The incident occurred the same day as two other unrelated exploits (AFX and VerusCoin), and some secondary reports bundled all three into a combined loss figure, though that framing is not clearly sourced to a single named analytics firm.","sections":[{"content":"On or around July 22-23, 2026, BSquared Network (B²), a project building Bitcoin layer-2 infrastructure, disclosed a security incident affecting its $B2 token staking service. According to the project's own statement as reported by secondary outlets, the breach involved unauthorized access to the staking contract's upgrade authority. On-chain analysts reported that the attacker drained approximately 8.591 million B2 tokens, valued at roughly $3.86 million at the time, from the BNB Chain-based staking contract. Some analysts suggested the privileged wallet used in the attack had held upgrade-authority access since 2025, raising the possibility of compromised internal credentials or an insider threat; this angle was not confirmed by the project and remains an allegation attributed to unnamed blockchain analysts.","heading":"The Exploit","sources":[{"url":"https://www.kucoin.com/news/flash/b2-network-suffers-hack-loses-3-86m-in-b2-tokens","name":"B2 Network Suffers Hack, Loses $3.86M in B2 Tokens","type":"news_article","credibility":2},{"url":"https://pro.edgex.exchange/en-US/news/article/b2-network-exploit-staking-contract-hack","name":"B² Network Exploited for $3.86M, Offers Attacker Legal Immunity for Partial Refund","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/flash/b-network-suspected-of-exploit-8-591-million-b2-tokens-stolen","name":"B network suspected of exploit, 8.591 million B2 tokens stolen","type":"news_article","credibility":2}],"severity":"high"},{"content":"BSquared Network stated that it had identified the security incident, temporarily suspended all B2 staking operations pending a security review, and described the incident as contained. The project pledged full compensation for affected users and directed those wishing to unstake to submit requests through its official Discord, with processing expected within one business day after identity/ownership verification. The team also issued an on-chain leniency offer: if the attacker returned at least 10% of the stolen funds (approximately $386,000) to a designated address within 24 hours, the project said it would not pursue legal action, framing the offer as a goodwill gesture. Reporting indicates this deadline passed without public confirmation of a return, and no outlet in current search results confirms the attacker complied.","heading":"Project Response and Leniency Offer","sources":[{"url":"https://pro.edgex.exchange/en-US/news/article/b2-network-exploit-staking-contract-hack","name":"B² Network Exploited for $3.86M, Offers Attacker Legal Immunity for Partial Refund","type":"news_article","credibility":2}],"severity":"medium"},{"content":"On-chain analysts (cited in secondary reporting as PeckShield and the pseudonymous researcher Specter) reported that the attacker swapped the stolen B2 tokens for roughly 5,409 Wrapped BNB (valued at approximately $3.0-3.1 million depending on the source and timing), then bridged the proceeds to Ethereum. Reports diverge on the next step: one account says the funds were swapped into ETH and USDT and routed toward NEAR Intents and HOT Protocol, while another says the attacker converted proceeds into roughly 1,128 ETH before bridging out via NEAR Intents. Multiple reports describe an intent to move funds toward Zcash, a privacy-focused blockchain, via NEAR Intents, in an apparent attempt to obscure the transaction trail. These later-stage laundering details rely on secondary, Tier 2 analyst commentary rather than a directly verified on-chain trace, and should be treated as alleged rather than confirmed.","heading":"Fund Movement and Laundering Path","sources":[{"url":"https://pro.edgex.exchange/en-US/news/article/b2-network-exploit-staking-contract-hack","name":"B² Network Exploited for $3.86M, Offers Attacker Legal Immunity for Partial Refund","type":"news_article","credibility":2},{"url":"https://www.coingabbar.com/en/crypto-currency-news/recent-crypto-hacks-news","name":"Recent Crypto Hack News: $35.55M Lost in Three Attacks","type":"news_article","credibility":2}],"severity":"medium"},{"content":"The BSquared/B² exploit occurred on the same day as two unrelated incidents: an exploit of the Arbitrum-based perpetual exchange AFX (about 24.15 million USDC, roughly $24.15 million, detected by Blockaid at 21:30 UTC on July 22, 2026) and an exploit of the VerusCoin Ethereum bridge (estimated by PeckShield at about $7.55 million, with funds reportedly routed through Tornado Cash). Secondary coverage summed the three incidents to a combined loss of approximately $35.55 million, attributing the individual loss estimates to security firms Blockaid and PeckShield. Some reports attribute a similar aggregate figure to the analytics account Lookonchain, but no source identified in this research directly quotes Lookonchain making that $35.55 million combined claim; this attribution should be treated as unverified. The three incidents are not reported as connected to a common attacker or vulnerability.","heading":"Combined Losses Across Three Unrelated Incidents on the Same Day","sources":[{"url":"https://www.coingabbar.com/en/crypto-currency-news/recent-crypto-hacks-news","name":"Recent Crypto Hack News: $35.55M Lost in Three Attacks","type":"news_article","credibility":2}],"severity":"low"},{"content":"Following disclosure of the exploit, the B2 token reportedly fell sharply, with one outlet citing a decline of approximately 44% before a partial recovery. This price-impact figure comes from a single secondary source and has not been independently cross-verified against exchange price data in this research.","heading":"Market Impact","sources":[{"url":"https://ambcrypto.com/bsquared-hack-drains-3-9m-can-b2-recover-after-a-44-crash/","name":"BSquared Hack Drains $3.9M: Can B2 Recover After a 44% Crash?","type":"news_article","credibility":2}],"severity":"low"},{"content":"No primary source — such as BSquared's own official X/Twitter post, an official blog post, or a directly linked on-chain transaction hash — was located during this research; all claims about the exploit, the leniency offer, and fund movements derive from secondary news aggregation and crypto-news outlets (KuCoin News Flash, edgeX News, AmbCrypto, CoinGabbar), several of which appear to republish the same underlying wire content. This is a material coverage gap: readers should treat exact figures (token amounts, WBNB/ETH conversion totals, percentage price drops) as approximate and subject to revision pending a verifiable primary statement from BSquared Network or a block-explorer-confirmed transaction record.","heading":"Sourcing Limitations","sources":[{"url":"https://pro.edgex.exchange/en-US/news/article/b2-network-exploit-staking-contract-hack","name":"B² Network Exploited for $3.86M, Offers Attacker Legal Immunity for Partial Refund","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2026-07","event":"BSquared Network's B2 token staking contract is exploited via unauthorized access to its upgrade authority on BNB Chain; approximately 8.591 million B2 tokens (about $3.86 million) are drained.","source":"KuCoin News Flash / edgeX News","source_url":"https://www.kucoin.com/news/flash/b2-network-suffers-hack-loses-3-86m-in-b2-tokens"},{"date":"2026-07","event":"BSquared Network suspends B2 staking operations, pledges full compensation for affected users, and offers to forgo legal action if the attacker returns at least 10% of stolen funds within 24 hours.","source":"edgeX News","source_url":"https://pro.edgex.exchange/en-US/news/article/b2-network-exploit-staking-contract-hack"},{"date":"2026-07","event":"Attacker reportedly swaps stolen B2 tokens for Wrapped BNB, bridges proceeds to Ethereum, and begins routing funds toward NEAR Intents, with reports suggesting an eventual move toward Zcash.","source":"edgeX News / CoinGabbar","source_url":"https://www.coingabbar.com/en/crypto-currency-news/recent-crypto-hacks-news"},{"date":"2026-07","event":"Secondary coverage groups the BSquared exploit with unrelated same-day exploits of AFX (~$24.15M) and the VerusCoin Ethereum bridge (~$7.55M), citing a combined loss figure of roughly $35.55 million.","source":"CoinGabbar (citing Blockaid and PeckShield)","source_url":"https://www.coingabbar.com/en/crypto-currency-news/recent-crypto-hacks-news"}],"sources_used":[{"url":"https://www.kucoin.com/news/flash/b2-network-suffers-hack-loses-3-86m-in-b2-tokens","name":"B2 Network Suffers Hack, Loses $3.86M in B2 Tokens","type":"news_article","credibility":2},{"url":"https://pro.edgex.exchange/en-US/news/article/b2-network-exploit-staking-contract-hack","name":"B² Network Exploited for $3.86M, Offers Attacker Legal Immunity for Partial Refund","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/flash/b-network-suspected-of-exploit-8-591-million-b2-tokens-stolen","name":"B network suspected of exploit, 8.591 million B2 tokens stolen","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/bsquared-hack-drains-3-9m-can-b2-recover-after-a-44-crash/","name":"BSquared Hack Drains $3.9M: Can B2 Recover After a 44% Crash?","type":"news_article","credibility":2},{"url":"https://www.coingabbar.com/en/crypto-currency-news/recent-crypto-hacks-news","name":"Recent Crypto Hack News: $35.55M Lost in Three Attacks","type":"news_article","credibility":2}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-08-18T17:05:00.122971+00:00","updated_at":"2026-11-03T17:53:31.96+00:00"},"source_quality":{"total":5,"tier1":0,"tier2":0,"tier3":0,"unrated":5},"follower_count":null,"content_updated_at":"2026-11-03T17:53:32.765Z","last_fact_checked_at":"2026-11-03T17:53:32.323Z","fact_check_next_allowed_at":"2026-11-10T17:53:32.323Z","update_next_allowed_at":"2026-11-10T16:28:32.135Z"}