Bitcoin News Today: $14.5B in Bitcoin Stolen from LuBian Mining Pool in 2020 Security Breach

Blockchain analytics firm Arkham Intelligence has uncovered what may be the largest undisclosed cryptocurrency theft in history, revealing a staggering $14.5 billion in Bitcoin stolen from a Chinese mining pool known as LuBian in December 2020. The breach went undetected for years, with the disappearance of LuBian in early 2021 previously attributed to regulatory action or a quiet shutdown. However, Arkham’s investigation points to a catastrophic security failure, likely caused by a weak private key generation algorithm [1].

LuBian, which operated from April 2020 until its sudden exit in early 2021, quickly became the sixth-largest mining pool on the Bitcoin network. It marketed itself as “the safest high-yielding mining pool in the world.” Arkham’s findings indicate that the pool was not shut down but rather drained of nearly all its Bitcoin reserves in a matter of days [1].

The attack was executed through a vulnerability in LuBian’s private key generation process. The firm allegedly used an insecure method that allowed attackers to guess or brute-force the keys. On December 28, 2020, hackers stole over 90% of LuBian’s Bitcoin—127,426 BTC—valued at $3.5 billion at the time. The following day, an additional $6 million in BTC and USDT was siphoned from one of LuBian’s addresses [1].

In a rare move, LuBian used the OP_RETURN field of Bitcoin transactions to send messages to the hacker, essentially issuing a digital ransom note. The messages urged the attacker to return the stolen assets and offered a reward in exchange. Despite these attempts, no assets have been returned [1].

Significantly, the stolen Bitcoin has remained dormant since July 2024, with none of the 127,426 BTC being moved. This inactivity suggests the attacker is either waiting for a more favorable opportunity or has been unable to move the funds without attracting attention. Meanwhile, LuBian managed to retain 11,886 BTC, worth approximately $1.35 billion, which remains in known wallets [1].

The implications of the breach extend beyond LuBian. It highlights a critical vulnerability in the cryptocurrency mining ecosystem—private key security. Unlike more common attacks such as phishing or smart contract exploits, this breach targeted the core of cryptographic security, underscoring the need for robust key management practices across the industry [1].

The stolen funds are unlikely to be spent anytime soon. Their large volume makes them easily trackable, and any attempt to move even a fraction of them would immediately attract the attention of exchanges, law enforcement, and blockchain analysts. As surveillance technologies continue to evolve, the window for a stealthy recovery of the assets is narrowing [1].

Arkham’s report has brought renewed attention to the case, potentially alerting law enforcement to the breach if they were not already aware. Should the stolen Bitcoin ever move, it would trigger real-time alerts across the crypto intelligence community. The incident serves as a stark reminder that even large and seemingly secure operations can be compromised by fundamental security flaws [1].

Source: [1] Arkham Uncovers 2020 Bitcoin Theft Worth $14.5B (https://coinmarketcap.com/community/articles/688f0ec29637a10c6ec66a73/)