Author: Arkham
Compiled by: Wenser, Odaily Planet Daily
With the cryptocurrency market currently in a downward trend, on-chain data platform Arkham released a lengthy article yesterday revealing a hacking incident that can be described as 'the largest BTC theft in history,' with the involved platform being the well-known BTC mining pool LuBian. This platform once controlled 6% of the total hash power resources of the Bitcoin network but suffered a theft of over 127,000 BTC in December 2020, which is currently valued at about $14.5 billion. Odaily Planet Daily will organize this nearly 5-year-old hacking incident for readers' reference.
The largest BTC theft in history: over 127,000 BTC, now valued at $14.5 billion
Recently, the on-chain data platform Arkham revealed that the 'largest BTC theft in history' has come to light—the involved platform is the LuBian mining pool.
It is understood that the main mining equipment of this pool is deployed in China and Iran. According to on-chain data analysis, in December 2020, 127,426 BTC were stolen from the LuBian mining pool, valued at $3.5 billion at the time, now worth about $14.5 billion. As of the time of writing, neither LuBian nor the hackers involved in this theft have publicly acknowledged the hacking attack.
On-chain data analysis diagram
'LuBian BTC Theft Case' details are as follows:
In 2020, as one of the world's largest BTC mining pools, LuBian officially began operations. It is reported that this mining pool was founded and managed by Chinese miners and is a private pool. According to Glassnode data, this pool began mining in March 2020; BTC.com shows that the Lubian pool first produced blocks in April 2020. By May 2020, it controlled nearly 6% of the total hash power resources of the Bitcoin network. However, after block 672,636 on February 28, 2021, the mining activities of this pool came to an end.
The LuBian mining pool once ranked among the top 10 in the industry
The number of blocks mined monthly by Lubian.com
On December 28, 2020, the LuBian mining pool was first attacked by hackers, with over 90% of the Bitcoin in the pool stolen.
On December 29, 2020, around $6 million worth of Bitcoin and USDT were stolen again from an active address belonging to Lubian on the Bitcoin Omni layer.
On December 31, 2020, LuBian transferred the remaining funds to other wallets.
On-chain message sent by LuBian to the hackers
According to screenshots, all hacker addresses received OP_RETURN on-chain messages from LuBian, pleading for the hackers to return the stolen funds.
According to on-chain information, LuBian sent these messages through 1,516 transactions, spending 1.4 BTC, indicating that these on-chain messages were not fabricated by other hackers through brute-forcing private keys (Odaily Planet Daily note: after all, very few people would send so many messages and incur such high costs for on-chain communication unless forced to do so).
Existing information suggests that the LuBian mining pool may have used an algorithm vulnerable to brute-force attacks to generate its private keys, which became a loophole exploited by hackers.
On-chain information shows that addresses related to the LuBian mining pool still hold 11,886 BTC, currently valued at $1.36 billion.
LuBian address asset information
On the other hand, on-chain information indicates that the hackers in the LuBian theft still hold the stolen BTC, with their last on-chain activity being a wallet consolidation in July 2024.
LuBian hacker address asset information
At that time, the stolen assets of LuBian were valued at $3.5 billion, making it the largest hacking theft security incident in history.
Due to the continuous rise in Bitcoin prices since 2020, the 127,400 BTC stolen from LuBian is currently valued at about $14.5 billion. This asset has made the LuBian hacker the 13th largest individual holder of Bitcoin in Arkham's statistical data, even surpassing the hacker from the Mt. Gox theft case that year.
Additionally, according to an article from the Compass Mining website, the LuBian mining pool is suspected of having rebranded to Roadside Mining. During the period from May 2020 to February 2021, the LuBian mining pool's operations seemed to be running at full speed, with an average monthly block mining volume of up to 174. In nearly a year of mining, it accumulated over 16,200 BTC, which were valued at over $1 billion at the peak price point in April 2021.
And now, the once-leading mining pool has ceased operations, leaving behind the history of this nearly 5-year-old 'largest BTC theft in history,' evoking deep sentiment.
