Arkham Intelligence has uncovered and shared a record-breaking hacking attack dating back to December 2020 that has long remained hidden from public view.
Hackers are believed to have stolen 127,426 Bitcoins from LuBian, a Chinese mining pool, in 2020. At the time of the theft, the value amounted to $3.5 billion, but with the rise in Bitcoin's price this year, the value of the stolen BTC has risen to an incredible total of $14.5 billion.
LuBian Violated in 2020
LuBian operated large-scale mining facilities in China and Iran, and was one of the leading Bitcoin mining pools, accounting for about 6% of the global hash rate in 2020. According to on-chain data analysis conducted by Arkham, more than 90% of the pool's Bitcoin reserves were transferred in one large transaction on 28 December 2020. Two days later, on 30 December, a small amount of funds was also taken from a Bitcoin address on Omni Layer associated with the pool.
LuBian never made the theft public, and neither the identity of the thief nor where the funds ended up is known. The stolen Bitcoins remained unaccounted for for over three years, until, in July 2024, Arkham detected a consolidation phase of the stolen funds that set off alarms. The investigation team managed to link several Bitcoin addresses involved in the hack, which had received OP_RETURN messages from LuBian's developers.
"LuBian was a Chinese mining pool with facilities in China and Iran. On-chain data shows that in December 2020, 127,426 BTC were stolen, then worth $3.5 billion and now worth about $14.5 billion," reported Arkham.
BREAKING: ARKHAM UNCOVERS $3.5B HEIST - THE LARGEST EVER
LuBian was a Chinese mining pool with facilities in China & Iran. Based on analysis of on-chain data, it appears that 127,426 BTC was stolen from LuBian in December 2020, worth $3.5 billion at the time and now worth... pic.twitter.com/PnIOKgMt0i
The messages, sent with a total of 1.4 BTC across 1,516 transactions, urged the wallets to return the "hacked BTC". The wallets' activities, including the consolidation phase and usage patterns, strongly suggest that the hack is real and not a simulation. To date, the thief has made no further movements with the stolen BTCs.
With 127.426 BTC in possession, the hacker ranks 13th in the world in terms of the amount of Bitcoin held.
Arkham's analysis indicates that the cause of the breach is most likely a vulnerability in the key generation algorithm used by LuBian, which would have rendered the servers' private keys susceptible to brute-force attacks.
Despite the incident, LuBian still holds a significant amount of Bitcoin: about 11,886 BTC in his wallets, worth about $1.35 billion.
The news has only just been published, but has already surpassed the previous record of the 1.5 billion theft suffered by Bybit in February 2025.
Arkham warned that this theft could be "a loud wake-up call for the crypto community", highlighting the serious vulnerabilities of poorly protected legacy infrastructure, especially in the mining sector.
After such a long and silent leak, all eyes are now on the hacker: will he ever move the stolen billions - or will they remain in the shadows forever?
Eleven Drainer, a new phishing-as-a-service, is expanding its business. Despite the sophistication of the attacks, human error remains the main weakness. The defence lies in user discipline.
Arkham Intelligence has uncovered and shared a record-breaking hacking attack dating back to December 2020 that has long remained hidden from public view.
Hackers are believed to have stolen 127,426 Bitcoins from LuBian, a Chinese mining pool, in 2020. At the time of the theft, the value amounted to $3.5 billion, but with the rise in Bitcoin's price this year, the value of the stolen BTC has risen to an incredible total of $14.5 billion.
LuBian Violated in 2020
LuBian operated large-scale mining facilities in China and Iran, and was one of the leading Bitcoin mining pools, accounting for about 6% of the global hash rate in 2020.
According to on-chain data analysis conducted by Arkham, more than 90% of the pool's Bitcoin reserves were transferred in one large transaction on 28 December 2020. Two days later, on 30 December, a small amount of funds was also taken from a Bitcoin address on Omni Layer associated with the pool.
LuBian never made the theft public, and neither the identity of the thief nor where the funds ended up is known. The stolen Bitcoins remained unaccounted for for over three years, until, in July 2024, Arkham detected a consolidation phase of the stolen funds that set off alarms. The investigation team managed to link several Bitcoin addresses involved in the hack, which had received OP_RETURN messages from LuBian's developers.
The messages, sent with a total of 1.4 BTC across 1,516 transactions, urged the wallets to return the "hacked BTC". The wallets' activities, including the consolidation phase and usage patterns, strongly suggest that the hack is real and not a simulation. To date, the thief has made no further movements with the stolen BTCs.
With 127.426 BTC in possession, the hacker ranks 13th in the world in terms of the amount of Bitcoin held.
Arkham's analysis indicates that the cause of the breach is most likely a vulnerability in the key generation algorithm used by LuBian, which would have rendered the servers' private keys susceptible to brute-force attacks.
Despite the incident, LuBian still holds a significant amount of Bitcoin: about 11,886 BTC in his wallets, worth about $1.35 billion.
The news has only just been published, but has already surpassed the previous record of the 1.5 billion theft suffered by Bybit in February 2025.
Arkham warned that this theft could be "a loud wake-up call for the crypto community", highlighting the serious vulnerabilities of poorly protected legacy infrastructure, especially in the mining sector.
After such a long and silent leak, all eyes are now on the hacker: will he ever move the stolen billions - or will they remain in the shadows forever?
Read Next
32 Million Upbit Hack: Token Solana to Stars on the Korean Market!
Upbit suspends deposits and withdrawals after a hacker attack that embezzled 32 million in Solana tokens, causing heavy premiums in the Korean market.
UK crypto heist: convictions and self-custody risk
A heist of more than 4.3 million in cryptocurrencies in the UK calls into question the security of self-custody and the risks of the human factor.
Crypto Clash: Beijing Blames US for LuBian's 127,000 BTC Bitcoin Exploit
China accuses Washington of 'draining' 127,000 BTC from LuBian in 2020. Researchers link the exploit to a flaw in key generation.
New Eleven Drainer attack: threat to crypto wallets
Eleven Drainer, a new phishing-as-a-service, is expanding its business. Despite the sophistication of the attacks, human error remains the main weakness. The defence lies in user discipline.