Largest BTC theft in history exposed: Uncovered after 5 years, involving $14.5 billion
TechFlow Selected TechFlow Selected
Largest BTC theft in history exposed: Uncovered after 5 years, involving $14.5 billion
The hacker became the 13th largest BTC holder on Arkham platform with stolen assets, even surpassing the Mt.Gox hacker.
Navigating Web3 tides with focused insightsAuthor: Arkham
Translation: Wenser, Odaily Planet Daily
Editor's note: As the cryptocurrency market experiences volatility and decline, on-chain data platform Arkham yesterday published a detailed exposé revealing what is being called the "largest BTC theft in history," involving the well-known BTC mining pool LuBian. At its peak, this pool controlled 6% of the total computing power on the Bitcoin network but suffered a theft of over 127,000 BTC in December 2020—currently valued at approximately $14.5 billion. This article by Odaily Planet Daily compiles and summarizes this nearly five-year-old hacking incident for readers' reference.
Largest BTC Theft in History: Over 127,000 BTC Stolen, Now Worth $14.5 Billion
Recently, on-chain data platform Arkham revealed that the "largest BTC theft in history" has come to light—the incident involved the LuBian mining pool.
According to available information, the mining pool primarily operated mining equipment located in China and Iran. On-chain analysis shows that in December 2020, 127,426 BTC were stolen from LuBian, which were worth $3.5 billion at the time and are now valued at around $14.5 billion. As of publication, neither LuBian nor the hackers involved have publicly acknowledged the attack.
On-chain data analysis diagram
Details of the "LuBian BTC theft case" are as follows:
In 2020, LuBian officially launched operations as one of the world’s largest BTC mining pools. Reports suggest it was founded and managed by Chinese miners and operated as a private mining pool. According to Glassnode data, the pool began mining in March 2020; BTC.com shows that the Lubian mining pool first produced a block in April 2020. By May 2020, it controlled nearly 6% of the total hash rate on the Bitcoin network. However, after block 672,636 on February 28, 2021, the pool ceased all mining activities.
LuBian mining pool once ranked among the top 10 globally
Number of blocks mined monthly by Lubian.com
On December 28, 2020, the LuBian mining pool was attacked for the first time, resulting in over 90% of its Bitcoin being stolen.
On December 29, 2020, approximately $6 million worth of Bitcoin and USDT were again stolen from an active Bitcoin Omni-layer address associated with LuBian.
On December 31, 2020, LuBian transferred its remaining funds into other wallets.
On-chain message sent from LuBian to the hacker
Screenshots show that all hacker addresses received OP_RETURN on-chain messages from LuBian, pleading for the return of the stolen funds.
According to on-chain data, LuBian spent 1.4 BTC across 1,516 transactions to send these messages—an indication that these on-chain messages were not forged by other hackers through brute-force private key cracking (Odaily Planet Daily note: after all, few would send so many messages or incur such high costs for on-chain communication unless desperate).
Available information suggests that the LuBian mining pool may have used a weak algorithm vulnerable to brute-force attacks to generate its private keys, which became the exploited vulnerability.
On-chain data shows that addresses linked to the LuBian mining pool still hold 11,886 BTC, currently worth $1.36 billion.
Asset information of LuBian addresses
On the other hand, on-chain data indicates that the hacker behind the LuBian theft still holds the stolen BTC, with their last on-chain activity being a wallet consolidation in July 2024.
Asset information of LuBian hacker addresses
At the time, the stolen assets from LuBian were worth as much as $3.5 billion, making it the largest-scale hacking and theft security incident in history.
Due to the continuous rise in Bitcoin prices since 2020, the 127,400 BTC stolen from LuBian are now worth approximately $14.5 billion. This amount makes the LuBian hacker the 13th-largest individual Bitcoin holder according to Arkham's statistics, even surpassing the hacker from the Mt. Gox theft.
In addition, according to articles from Compass Mining, the LuBian mining pool appears to have rebranded as Roadside Mining. Between May 2020 and February 2021, LuBian’s mining operations seemed to be running at full capacity, averaging 174 blocks mined per month. Over nearly a year of mining, it accumulated over 16,200 BTC, which exceeded $1 billion in value at the April 2021 price peak.
Today, the once-top-tier mining pool has ceased operations, leaving behind only this five-year-old chapter of the "largest BTC theft in history," a truly lamentable tale.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
Odaily
