Editor's Note: In the current volatile and downward cryptocurrency market, the on-chain data platform Arkham released a long article yesterday revealing a hacking incident that can be considered the "largest BTC theft in history," involving the well-known BTC mining pool LuBian. The platform once controlled 6% of the total computing power of the Bitcoin network but was subjected to a theft of over 127,000 BTC in December 2020, currently valued at approximately $14.5 billion. Odaily will organize this hacking event that has been sealed for nearly 5 years for readers' reference.
Largest BTC Theft in History: Over 127,000 BTC, Currently Worth $14.5 Billion
Recently, the on-chain data platform Arkham disclosed that the "largest BTC theft in history" has surfaced - involving the LuBian mining pool.
According to information, the mining pool's mining equipment was mainly deployed in China and Iran. Based on on-chain data analysis, 127,426 BTC were stolen from the LuBian mining pool in December 2020, with the assets valued at $3.5 billion at the time and now worth approximately $14.5 billion. As of the time of writing, neither LuBian nor the hackers have publicly acknowledged this cyber attack.
Details of the "LuBian BTC Theft Case" are as follows:
In 2020, as one of the world's largest BTC mining pools, LuBian officially began operations, with reports suggesting it was established and managed by Chinese miners as a private mining pool. According to Glassnode data, the pool started mining in March 2020; BTC.com shows that the Lubian pool first produced a block in April 2020. By May 2020, it almost controlled 6% of the total computing power of the Bitcoin network. However, its mining activities ceased after block 672,636 on February 28, 2021.


On December 28, 2020, the LuBian mining pool was first hacked, with over 90% of its bitcoins stolen.
On December 29, 2020, approximately $6 million worth of bitcoin and USDT were stolen from an active address on the Bitcoin Omni layer belonging to Lubian.
On December 31, 2020, LuBian transferred the remaining funds to other wallets.


From the screenshots, all hacker addresses received OP_RETURN on-chain messages from the LuBian side, pleading with the hackers to return the stolen funds.
According to on-chain information, LuBian sent these messages through 1,516 transactions, spending 1.4 BTC, indicating that these on-chain messages were not forged by other hackers through brute-force private key cracking (Odaily note: after all, few would send so many messages and incur such high costs for on-chain communication unless desperate).
Current information suggests that the LuBian mining pool may have used an algorithm vulnerable to brute-force attacks for generating its private keys, which became the exploit used by hackers.
On-chain information shows that LuBian mining pool-related addresses still hold 11,886 BTC, currently valued at $1.36 billion.

On the other hand, on-chain information indicates that the hackers in the LuBian theft case still hold the stolen BTC, with their last on-chain activity being a wallet consolidation in July 2024.

At the time, the stolen assets from LuBian were worth $3.5 billion, making it the largest hacking theft event in history.
Due to the continuous rise in Bitcoin prices since 2020, the 127,400 BTC stolen from LuBian are currently valued at approximately $14.5 billion. These assets have made the LuBian hackers the 13th largest Bitcoin holder on the Arkham platform, even surpassing the hackers from the Mt. Gox theft case.
Additionally, according to an article on the Compass Mining website, the LuBian mining pool appears to have been rebranded as Roadside Mining. Between May 2020 and February 2021, the LuBian mining pool seemed to be operating at full speed, with an average monthly block mining volume of 174. During this period, they accumulated over 16,200 BTC, which at the price peak in April 2021 was worth over $1 billion.
Now, the once-top mining pool has ceased operations, leaving behind this sealed 5-year "largest BTC theft in history," evoking sighs of emotion.
Click to learn about BlockBeats job openings
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Twitter Official Account: https://twitter.com/BlockBeatsAsia


