The largest BTC theft in history exposed: over 127,000 BTC, currently valued at 14.5 billion USD.

Original Author: Arkham

Compiled by | Odaily Planet Daily

Translator | Wenser

Editor's Note: Amidst the current turbulence in the cryptocurrency market, the on-chain data platform Arkham released a lengthy article yesterday revealing what is considered the "largest BTC theft in history" involving the well-known BTC mining pool LuBian. The platform once controlled 6% of the total computing power of the Bitcoin network, but in December 2020, it suffered a theft of over 127,000 BTC, which is currently valued at approximately 14.5 billion USD. Odaily Planet Daily will organize this nearly 5-year-old hacking event in this article for readers' reference.

The largest BTC theft in history: over 127,000 BTC, currently worth 14.5 billion USD

Recently, the on-chain data platform Arkham disclosed that "the largest BTC theft in history" has come to light - the platform involved is the LuBian mining pool.

According to reports, the mining equipment of this pool is mainly deployed in China and Iran. Based on on-chain data analysis, in December 2020, 127,426 BTC were stolen from the LuBian mining pool, which was valued at 3.5 billion dollars at the time and is now worth about 14.5 billion dollars. As of the time of this report, neither LuBian nor the hackers involved in this theft have publicly acknowledged the hack.

On-chain data analysis diagram

The details of the "LuBian BTC theft case" are as follows:

In 2020, LuBian officially started operations as one of the largest BTC mining pools in the world. It is reported that this mining pool was founded and managed by Chinese miners and is a private pool. According to Glassnode data, this mining pool began mining in March 2020; BTC.com shows that the Lubian pool first produced a block in April 2020. As of May 2020, it controlled nearly 6% of the total hash power of the Bitcoin network. However, after block 672,636 on February 28, 2021, the mining activities of this pool came to an end.

LuBian mining pool once ranked in the top 10 of the industry.

Number of blocks mined by Lubian.com each month

On December 28, 2020, the LuBian mining pool was first attacked by hackers, with over 90% of the Bitcoin in the pool stolen.

On December 29, 2020, approximately 6 million USD worth of Bitcoin and USDT were stolen again from an active address on the Bitcoin Omni layer belonging to Lubian.

On December 31, 2020, LuBian transferred the remaining funds to other wallets.

On-chain message sent by LuBian to the hacker

According to the screenshot, all hacker addresses received OP_RETURN on-chain messages from LuBian, pleading with the hackers to return the stolen funds.

According to on-chain information, LuBian sent these messages through 1516 transactions, spending 1.4 BTC, which indicates that these on-chain messages are not a result of information forgery by other hackers through brute-forcing private keys (Odaily Planet Daily note: After all, very few people would send this many messages and incur such high costs for on-chain communication unless absolutely compelled).

Current information indicates that the LuBian mining pool may have used an algorithm that is susceptible to brute force attacks to generate its private keys, which has become a vulnerability exploited by hackers.

On-chain information shows that the LuBian mining pool related address still holds 11,886 BTC, currently valued at 1.36 billion USD.

LuBian address asset information

On the other hand, on-chain information shows that the hacker involved in the LuBian theft still holds the stolen BTC, with their last on-chain activity being a wallet consolidation that took place in July 2024.

LuBian hacker address asset information

At that time, the stolen assets of LuBian were valued at up to 3.5 billion dollars, making it the largest hacking theft security incident in history.

Due to the continuous rise in Bitcoin prices since 2020, the 127,400 BTC stolen from LuBian is currently valued at approximately $14.5 billion. This asset has made the LuBian hacker the 13th largest individual holder of Bitcoin in Arkham platform statistics, even surpassing the hacker from the Mt. Gox theft that year.

Additionally, according to information from the Compass Mining website, the LuBian mining pool is suspected to have rebranded as Roadside Mining. From May 2020 to February 2021, the mining operations of the LuBian mining pool seemed to be in full swing, with an average monthly block mining volume of up to 174 blocks. Over the past year, it has accumulated more than 16,200 BTC in mining, and at the price peak in April 2021, the asset value of these BTC exceeded 1 billion dollars.

And now, the once leading mining pools have ceased operations, leaving behind the history of the "largest BTC theft in history" that has been sealed for 5 years, which is truly lamentable.