The largest BTC theft case in history exposed: sealed for 5 years, involving an amount of 14.5 billion dollars

Author: Arkham

Compiled by: Wenser, Odaily Planet Daily

As the cryptocurrency market experiences a turbulent downturn, the on-chain data platform Arkham published a lengthy article yesterday revealing what can be considered "the largest BTC theft in history," involving the well-known BTC mining pool LuBian. This platform once controlled 6% of the total hash power of the Bitcoin network but suffered a theft of over 127,000 BTC in December 2020, which is currently valued at approximately $14.5 billion. Odaily Planet Daily will organize this nearly five-year-old hacking incident for readers' reference.

The Largest BTC Theft in History: Over 127,000 BTC, Currently Valued at $14.5 Billion

Recently, the on-chain data platform Arkham disclosed that "the largest BTC theft in history" has come to light— the involved platform is the LuBian mining pool.

It is understood that the mining equipment of this pool is mainly deployed in China and Iran. According to on-chain data analysis, in December 2020, 127,426 BTC were stolen from the LuBian mining pool, which was valued at $3.5 billion at the time and is now worth approximately $14.5 billion. As of the time of publication, neither LuBian nor the hackers involved in this theft have publicly acknowledged the hacking incident.

On-chain data analysis illustration

Details of the "LuBian BTC Theft Case" are as follows:

In 2020, as one of the largest BTC mining pools in the world, LuBian officially began operations. It is reported that this mining pool was founded and managed by Chinese miners and is a private pool. According to Glassnode data, this mining pool started mining in March 2020; BTC.com shows that the Lubian pool first produced a block in April 2020. By May 2020, it controlled nearly 6% of the total hash power of the Bitcoin network. However, after block 672,636 on February 28, 2021, the mining activities of this pool came to an end.

LuBian mining pool ranked among the top 10 in the industry

Number of blocks mined by Lubian.com each month

On December 28, 2020, the LuBian mining pool was first attacked by hackers, with over 90% of the Bitcoin in the pool stolen.

On December 29, 2020, approximately $6 million worth of Bitcoin and USDT were again stolen from an active address belonging to Lubian on the Bitcoin Omni layer.

On December 31, 2020, LuBian transferred the remaining funds to other wallets.

On-chain messages sent by LuBian to the hackers

According to screenshots, all hacker addresses received OP_RETURN on-chain messages from LuBian, pleading with the hackers to return the stolen funds.

On-chain information shows that LuBian sent these messages through 1,516 transactions, spending 1.4 BTC, indicating that these on-chain messages were not fabricated by other hackers through brute-forcing private keys (Odaily Planet Daily notes: after all, very few people would send so many messages and incur such high costs for on-chain communication unless absolutely forced).

Current information suggests that the LuBian mining pool may have used an algorithm that is susceptible to brute-force attacks to generate its private keys, which became a vulnerability exploited by the hackers.

On-chain information shows that addresses related to the LuBian mining pool still hold 11,886 BTC, currently valued at $1.36 billion.

LuBian address asset information

On the other hand, on-chain information indicates that the hackers involved in the LuBian theft still hold the stolen BTC, with their last on-chain activity being a wallet consolidation in July 2024.

LuBian hacker address asset information

At that time, the value of the stolen assets from LuBian reached $3.5 billion, marking it as the largest hacking theft security incident in history.

Due to the continuous rise in Bitcoin prices since 2020, the 127,000 BTC stolen from LuBian is currently valued at approximately $14.5 billion. This asset has made the LuBian hacker the 13th largest individual holder of Bitcoin in Arkham's statistical data, even surpassing the hacker from the Mt. Gox theft case that year.

Additionally, according to information from an article on the Compass Mining website, the LuBian mining pool is suspected to have rebranded as Roadside Mining. During the period from May 2020 to February 2021, the mining operations of the LuBian pool seemed to be in full swing, averaging 174 blocks mined per month. It accumulated over 16,200 BTC in nearly a year of mining, and at the price peak in April 2021, these BTC were valued at over $1 billion.

Now, the once-leading mining pool has ceased operations, leaving behind the history of this nearly five-year-old "largest BTC theft in history," evoking deep reflections.