- Hackers withdrew 127,426 BTC from China‑based mining pool LuBian in Dec 2020, recording the biggest crypto heist in history.
- Arkham’s on‑chain forensics suggest a fundamental flaw in LuBian’s private‑key generation algorithm, which led to the compromise.
- By 2021, LuBian moved its remaining 11,886 BTC (~$1.3 billion today) into recovery wallets.
Blockchain analytics firm Arkham Intelligence uncovered one of the biggest crypto heists in history on August 2. In an X post, Arkham’s on‑chain analysis revealed that 127,426 BTC was quietly siphoned from China‑based Lubian Mining Pool on December 28, 2020. Valued at ~$3.5 billion when stolen, the BTC is now worth roughly $14.5 billion at current exchange rates.
Attackers drained over 90% of Lubian’s balance within hours. And that was not it, a secondary theft was reported the next day, which erased ~$6 million more, partly via an Omni‑protocol USDT address. Arkham traced the breach to a fundamental flaw in Lubian’s private key generation process, calling it vulnerable to brute‑force attacks. Once keys were brute‑forced, the hacker gained control over the pool’s BTC wallets.
In fact, Lubian did attempt to recover the funds by sending 1,516 OP_RETURN messages into the chain, pleading for the hacker to contact them and negotiate a return. However, no response was ever received.
Neither Lubian nor Arkham has identified the perpetrator. The address does not correspond to known darknet auctions, and the group has made zero public contact. Analysts speculate the attacker may be strategically waiting for a market window or possibly trapped within surveillance constraints.
Lubian Pool: Rise & fallout
Launched in mid‑2020, Lubian quickly rose to become the sixth‑largest Bitcoin mining pool globally, commanding nearly 6% of the network’s hash rate and operating facilities across China and Iran. Amidst tightening Chinese crypto regulations, the firm vanished in February 2021, with no public disclosure, now believed to be a direct result of the hack.
As of July 2024, a consolidation moved the stolen stash into a single address. Apart from a Binance test transfer in September 2024, the BTC has remained completely dormant, marking the hacker’s wallet as the 13th‑largest BTC address in the world. On the other hand, Lubian still possesses about 11,886 BTC or approximately $1.35 billion at the current rate, in cold storage. Its leadership remains silent, and no regulator or partner has launched an investigation.
