Written by: Arkham
Compiled by: Wenser, Odaily Planet Daily
Editor's note: As the cryptocurrency market is currently in a turbulent downward trend, the on-chain data platform Arkham released a lengthy article yesterday revealing a hacking incident that can be described as 'the largest BTC theft in history,' involving the well-known BTC mining pool LuBian. The platform once controlled 6% of the total Bitcoin network hash rate but suffered a theft of over 127,000 BTC in December 2020, currently valued at about $14.5 billion. Odaily Planet Daily will compile this long-buried hacking event from nearly 5 years ago for readers' reference.
The largest BTC theft in history: over 127,000 BTC, currently valued at $14.5 billion
Recently, the on-chain data platform Arkham published an article revealing that 'the largest BTC theft in history' has come to light—the platform involved is the LuBian mining pool.
It is understood that the mining pool's main mining equipment was deployed in China and Iran. According to on-chain data analysis, in December 2020, 127,426 BTC were stolen from the LuBian mining pool, which was valued at $3.5 billion at the time and is now worth approximately $14.5 billion. As of the time of writing, neither LuBian nor the hackers involved in this theft have publicly acknowledged the hacking attack.
On-chain data analysis diagram
'Details of the LuBian BTC theft case' are as follows:
In 2020, LuBian officially began operations as one of the largest BTC mining pools in the world. Reports suggest that the pool was founded and managed by Chinese miners and is a private pool. According to Glassnode data, the pool started mining in March 2020; BTC.com shows that the Lubian pool first produced blocks in April 2020. By May 2020, it controlled nearly 6% of the total Bitcoin network hash rate. However, after block 672,636 on February 28, 2021, the mining activities of this pool came to an end.
LuBian mining pool once ranked among the top 10 in the industry
The number of blocks mined monthly by Lubian.com
On December 28, 2020, the LuBian mining pool was first hacked, with over 90% of the Bitcoin in the pool being stolen.
On December 29, 2020, Bitcoin and USDT worth approximately $6 million were stolen again from an active address belonging to Lubian on the Bitcoin Omni layer.
On December 31, 2020, LuBian transferred the remaining funds to other wallets.
On-chain messages sent by LuBian to the hackers
According to the screenshots, all hacker addresses received OP_RETURN on-chain messages from LuBian, pleading with the hackers to return the stolen funds.
According to on-chain information, LuBian sent these messages through 1,516 transactions, spending 1.4 BTC, indicating that these on-chain messages were not fabricated by other hackers through brute force cracking of private keys (Odaily Planet Daily notes: after all, very few people would send so many messages and incur such high costs for on-chain communication unless forced to do so).
Current information suggests that the LuBian mining pool may have used an algorithm that is easily susceptible to brute-force attacks to generate its private keys, which became a vulnerability exploited by hackers.
On-chain information shows that addresses related to the LuBian mining pool still hold 11,886 BTC, currently valued at $1.36 billion.
LuBian address asset information
On the other hand, on-chain information shows that the hackers involved in the LuBian theft still hold the stolen BTC, with their last on-chain activity being a wallet consolidation that took place in July 2024.
LuBian hacker address asset information
At that time, the value of the stolen assets from LuBian reached as high as $3.5 billion, marking the largest hacking theft security event in history.
Due to the continuous rise in Bitcoin prices since 2020, the 127,400 BTC stolen from LuBian is currently worth approximately $14.5 billion. This asset made the LuBian hacker the 13th largest individual holder of Bitcoin in Arkham platform statistics, even surpassing the hacker from the 2014 Mt. Gox theft.
Additionally, according to an article on the Compass Mining website, the LuBian mining pool has seemingly rebranded to Roadside Mining. Between May 2020 and February 2021, the LuBian mining pool's operations appeared to be running at full speed, with an average monthly block production of up to 174. In the nearly year-long mining period, it accumulated over 16,200 BTC, which was valued at over $1 billion at the price peak in April 2021.
And now, the once leading mining pool has ceased operations, leaving behind this long-buried 'largest BTC theft in history' that evokes deep reflections.
