Thread by @arkham

BREAKING: ARKHAM UNCOVERS $3.5B HEIST - THE LARGEST EVER

LuBian was a Chinese mining pool with facilities in China & Iran. Based on analysis of on-chain data, it appears that 127,426 BTC was stolen from LuBian in December 2020, worth $3.5 billion at the time and now worth approximately $14.5 billion.

Neither LuBian nor the hacker have publicly acknowledged the hack. Arkham is the first to report it. Details below:

LuBian was one of the world’s largest mining pools in 2020, controlling almost 6% of the Bitcoin network’s total hash-rate as of May 2020.

They appear to have been first hacked on December 28th, 2020 for over 90% of their BTC. Subsequently, on December 29th, around $6M of additional BTC & USDT was stolen from a Lubian address active on Bitcoin Omni layer.

On the 31st, LuBian rotated their remaining funds to recovery wallets.

Each hacker address received the OP_RETURN message, shown in the screenshots, in which LuBian asks the hacker to return their funds.

LuBian spent 1.4 BTC across 1516 different transactions to send these messages, which suggests that this is not a spoof from another hacker who has brute-forced the private keys.

intel.arkm.com/explorer/tx/a7…
intel.arkm.com/explorer/tx/2a…

It appears that LuBian was using an algorithm to generate its private keys that was susceptible to brute-force attacks. This may have been the vulnerability exploited by the hackers.

LuBian preserved 11,886 BTC, currently worth $1.35B, which they still hold. The hacker also still holds the stolen BTC, with their last known movement being a wallet consolidation in July 2024.

With $3.5B in stolen assets at time of transfer, the LuBian hack is the largest ever.

Owing to BTC’s price appreciation since 2020, the current value of stolen assets is $14.5B, making the LuBian hacker the 13th largest BTC holder on Arkham, ahead of the Mt. Gox Hacker.

Track the LuBian Hacker on Arkham:

intel.arkm.com/explorer/entit…

Track LuBian.com on Arkham:

intel.arkm.com/explorer/entit…