Hacker still holds $14 billion in stolen Bitcoin from massive 2020 LuBian attack: Arkham

A massive theft of 127,426 Bitcoin (BTC) from the secretive Chinese mining pool LuBian in 2020, which was uncovered today, has sparked concerns in the crypto community as the hacker still holds the entire stash more than four years after the incident.

The stolen BTC stash, worth $3.5 billion at the time, is now valued at over $14 billion, according to a new report from Arkham Intelligence.

https://twitter.com/arkham/status/1951729798285340956?ref_src=twsrc%5Etfw” target=”_blank” rel=”nofollow noopener noreferrer

It is not only the biggest crypto heist in history but also one of the longest-concealed cases. LuBian, which controlled nearly 6% of Bitcoin’s network hash rate in May 2020, has never publicly disclosed the breach.

Inside the largest crypto heist

As traced by Arkham, the hack occurred on December 28, 2020, with more than 90% of LuBian’s BTC holdings being drained. Arkham suggests that LuBian used an insecure algorithm to generate private keys, which made them vulnerable to brute-force attacks.

The day after the attack, a LuBian-linked address lost an additional $6 million in Bitcoin and USDT on the Bitcoin Omni layer.

On December 31, LuBian moved its remaining 11,886 Bitcoin, currently worth about $1.3 billion, to recovery wallets.

After the hack, the firm broadcast messages across 1,516 Bitcoin transactions requesting the return of stolen funds, spending 1.4 Bitcoin in the process.

The hacker’s stash of 127,426 BTC remains untouched since a wallet consolidation in July 2024, while LuBian’s holdings sit at 11,886 BTC. The unknown exploiter has climbed to 13th place among the top BTC holders, outranking the infamous Mt. Gox hacker.

LuBian stopped mining in early 2021

The hack may explain why LuBian quietly disappeared from the Bitcoin network in early 2021. Given the firm’s secretive operations, it’s perhaps no surprise that the former top-tier miner chose to vanish rather than disclose a breach of this scale.

According to data from mempool.space, Lubian’s last known mining activity occurred on March 1, 2021, when it mined Bitcoin block 672,636.

At the time, industry observers speculated the halt was linked to China’s and Iran’s clampdown on crypto mining. Those regions were believed to be Lubian’s active areas.

China announced a crackdown on Bitcoin mining and trading in May 2021, followed by several provinces ordering shutdowns of mining operations through June.

By September 2021, Chinese authorities issued a nationwide notice declaring crypto mining an “obsolete” industry, effectively enacting a total ban on both mining and trading.