Original author:Arkham

Compiled by Odaily Planet Daily ( @OdailyChina )

Translator | Wenser ( @wenser2010 )

Editor's Note: Amidst the volatile downward trend in the cryptocurrency market, on-chain data platform Arkham published a lengthy article yesterday exposing what has been described as the "largest BTC theft in history." The hack involved LuBian, a prominent BTC mining pool. The platform, which once controlled 6% of the Bitcoin network's total computing power, suffered the theft of over 127,000 BTC in December 2020, currently valued at approximately $14.5 billion. Odaily Planet Daily will summarize this nearly five-year-old hack for readers' reference.

The largest BTC theft in history: over 127,000 BTC, now worth $14.5 billion

Arkham, an on-chain data platform, recentlypublished an article revealing that the “largest BTC theft in history” has surfaced—the platform involved is the LuBian mining pool.

The mining pool's primary mining equipment is reportedly deployed in China and Iran. According to on-chain data analysis, 127,426 BTC were stolen from the LuBian mining pool in December 2020. This amount, valued at $3.5 billion at the time and currently valued at approximately $14.5 billion, was stolen. As of press time, neither LuBian nor the hackers involved in the theft have publicly acknowledged the attack.

On-chain data analysis diagram

The details of the “LuBian BTC theft case” are as follows:

In 2020, LuBian, one of the world's largest Bitcoin mining pools, officially began operations. Reports indicate that the pool was founded and managed by Chinese miners and is privately owned. According to Glassnode data, the pool began mining in March 2020; BTC.com indicates that the Lubian pool produced its first block in April 2020. By May 2020, it controlled nearly 6% of the Bitcoin network's total computing power. However, mining ceased after block 672,636 on February 28, 2021.

LuBian Mining Pool was once ranked among the top 10 in the industry

The number of blocks mined per month by Lubian.com

On December 28, 2020, the LuBian mining pool was hacked for the first time, and more than 90% of the Bitcoin in the mining pool was stolen.

On December 29, 2020, approximately $6 million worth of Bitcoin and USDT was again stolen from an active address on the Bitcoin Omni layer belonging to Lubian.

On December 31, 2020, LuBian transferred the remaining funds to other wallets.

LuBian's on-chain message to the hacker

According to the screenshots, all hacker addresses received OP_RETURN on-chain messages from LuBian, begging the hackers to return the stolen funds.

According to on-chain information, LuBian sent these messages through 1,516 transactions and spent 1.4 BTC. This phenomenon shows that these on-chain messages were not forged by other hackers through brute force cracking of private keys (Odaily Planet Daily Note: After all, few people would send so many messages and spend such a high cost on on-chain communication unless they are forced to do so) .

Existing information shows that the LuBian mining pool may have used an algorithm that is vulnerable to brute force attacks to generate its private key, which has become a vulnerability exploited by hackers.

On-chain information shows that the LuBian mining pool-related addresses still hold 11,886 BTC, currently worth US$1.36 billion.

LuBian Address Asset Information

On the other hand, on-chain information shows that the hacker in the LuBian theft case still holds the stolen BTC, and his last on-chain activity was a wallet collection in July 2024.

LuBian hacker address asset information

At that time, the value of LuBian's stolen assets was as high as 3.5 billion US dollars, which was the largest hacker theft security incident in history.

Due to the continued rise in Bitcoin prices since 2020, the 127,400 BTC stolen from LuBian are currently valued at approximately $14.5 billion. This makes the LuBian hacker the 13th largest individual Bitcoin holder according to Arkham platform statistics, even surpassing the hacker in the Mt. Gox theft.

Additionally, according to an article on the Compass Mining website , the LuBian mining pool appears to have been rebranded as Roadside Mining. From May 2020 to February 2021, LuBian's mining operations appeared to be operating at full capacity, with an average monthly block mining output of 174. During this nearly year-long mining operation, the pool accumulated over 16,200 BTC, which was valued at over $1 billion at its peak in April 2021.

Today, the once leading mining pool has ceased operations, leaving behind only the history of the "largest BTC theft in history" that has been dormant for five years, which is truly regrettable.