Editor's note: In the current turbulent downward trend of the cryptocurrency market, on-chain data platform Arkham published a lengthy article yesterday revealing a hacker event that can be called "the largest BTC theft in history," involving the well-known BTC mining pool LuBian. The platform once controlled 6% of the total Bitcoin network hash rate but encountered the theft of over 127,000 BTC in December 2020, currently valued at approximately $14.5 billion. Odaily Planet Daily will organize this nearly 5-year-old hacking incident for readers' reference.

The largest BTC theft in history: over 127,000 BTC, currently valued at $14.5 billion

Recently, on-chain data platform Arkham revealed that "the largest BTC theft in history" has come to light—the platform involved is LuBian mining pool.

It is understood that the mining pool mainly deployed mining equipment in China and Iran. According to on-chain data analysis, in December 2020, 127,426 BTC from LuBian mining pool were stolen, which was valued at $3.5 billion at the time and is now valued at approximately $14.5 billion. As of the time of writing, neither LuBian nor the hackers involved in this theft have publicly acknowledged the hacking incident.

On-chain data analysis chart

"Details of the LuBian BTC theft case" are as follows:

In 2020, as one of the largest BTC mining pools in the world, LuBian officially began operations, with reports indicating that the pool was founded and managed by Chinese miners, making it a private pool. According to Glassnode data, the pool started mining in March 2020; BTC.com shows that the Lubian mining pool first produced blocks in April 2020. By May 2020, it controlled almost 6% of the total Bitcoin network hash rate. However, after block 672,636 on February 28, 2021, the mining activities of this pool came to an end.


LuBian mining pool ranked among the top 10 in the industry

Number of blocks mined by Lubian.com each month

On December 28, 2020, LuBian mining pool was first attacked by hackers, with over 90% of the Bitcoin in the pool stolen.

On December 29, 2020, approximately $6 million worth of Bitcoin and USDT was stolen again from an active address belonging to Lubian on a Bitcoin Omni layer.

On December 31, 2020, LuBian transferred the remaining funds to other wallets.


On-chain messages sent by LuBian to hackers

According to screenshots, all hacker addresses received OP_RETURN on-chain messages from LuBian, pleading with the hackers to return the stolen funds.

According to on-chain information, LuBian spent 1.4 BTC through 1,516 transactions to send these messages, indicating that these on-chain messages were not fabricated by other hackers through brute force cracking of private keys (Odaily Planet Daily note: After all, very few people would send so many messages and incur such high costs for on-chain communication unless forced).

Current information indicates that LuBian mining pool may have used an algorithm vulnerable to brute force attacks to generate its private keys, which became a flaw exploited by hackers.

On-chain information shows that addresses related to LuBian mining pool still hold 11,886 BTC, currently valued at $1.36 billion.

On the other hand, on-chain information shows that the hackers involved in the LuBian theft still hold the stolen BTC, with their last on-chain activity being a wallet consolidation in July 2024.

At that time, the stolen assets from LuBian were valued at up to $3.5 billion, making it the largest hacker theft security incident in history.

Due to the continuous rise in Bitcoin prices since 2020, the 127,400 BTC stolen from LuBian is currently valued at approximately $14.5 billion. This asset has made the LuBian hacker the 13th largest individual holder of Bitcoin in Arkham platform statistics, even surpassing the hackers involved in the Mt. Gox theft case that year.

Additionally, according to an article on the Compass Mining website, LuBian mining pool has reportedly rebranded to Roadside Mining. Between May 2020 and February 2021, LuBian mining pool's operations seemed to be running at full speed, averaging 174 blocks mined per month. In the past year, it accumulated over 16,200 BTC, and at the price peak in April 2021, the value of these BTC assets exceeded $1 billion.

Now, the once leading mining pool has stopped operating, leaving behind the dusty history of the "largest BTC theft in history" from 5 years ago, which evokes deep feelings.