Bitcoin now worth $14.5 billion quietly stolen from Chinese mining pool in 2020: Arkham

Blockchain intelligence platform Arkham Intelligence said it uncovered a previously undisclosed heist of 127,426 BTC, now worth nearly $14.5 billion, from Chinese mining pool LuBian in December 2020.

The heist appears to be the largest theft of crypto in terms of overall value at the time of the heist, with $3.5 billion worth of BTC stolen. Though Mt. Gox lost about 744,000 BTC over the course of its operation, the price of Bitcoin meant the coins were worth merely hundreds of millions of dollars at the time the exchange collapsed, rather than billions.

LuBian suddenly burst onto the mining scene in late April of 2020, growing quickly to become at one point the sixth-largest mining pool on the Bitcoin network. A message in Chinese on the pool's website referred to the pool as "the safest high yielding mining pool in the world."

Then, LuBian vanished just as suddenly in February of 2021, leaving crypto investors to speculate the pool may have been shut down by the Chinese government or had pivoted to a private pool. 

Yet according to Arkham's telling, LuBian shut down after a massive hack wiped out most of its reserves. "They appear to have been first hacked on December 28th, 2020 for over 90% of their BTC," Arkham wrote. "Subsequently, on December 29th, around $6M of additional BTC & USDT was stolen from a Lubian address active on Bitcoin Omni layer."

Arkham speculated that a weakness in LuBian's private key generating algorithm could be to blame for the exploit. "It appears that LuBian was using an algorithm to generate its private keys that was susceptible to brute-force attacks," Arkham wrote. "LuBian preserved 11,886 BTC, currently worth $1.35B, which they still hold."

Notably, the alleged hacker has not moved any of the BTC since July, 2024. LuBian had sent messages to several attacking addresses through Bitcoin's OP_RETURN field. "To the whitehat who is saving our asset, you can contact us...to discuss the return of asset and your reward," the message across two transactions reads. 

The message provided an email address, but it's currently unknown whether the alleged hacker ever responded. Arkham did not immediately respond to a request for comment from The Block.