- LuBian lost 127,426 BTC in a 2020 hack due to weak key generation, now worth $14.5 billion at current Bitcoin prices.
- Blockchain data confirms the hacker still controls the stolen funds, making them the 13th largest Bitcoin holder as per Arkham’s rankings.
- LuBian sent over 1,500 messages using OP_RETURN in 2020, urging the hacker to return the BTC, spending 1.4 BTC in the process.
The LuBian hacker behind the largest Bitcoin theft in history has been identified, according to blockchain intelligence platform Arkham. The attacker stole 127,426 BTC in December 2020, now worth $14.5 billion.
Arkham Links Hacker to 2020 LuBian Mining Pool Breach
On-chain analysis conducted by Arkham has uncovered that LuBian, a former Chinese Bitcoin mining pool, suffered a massive breach. In a post shared on X, Arkham stated, “127,426 BTC was stolen from LuBian in December 2020, worth $3.5 billion at the time and now worth approximately $14.5 billion.” This theft marks the largest in crypto history to date.
LuBian was among the world’s largest mining pools in 2020, controlling nearly 6% of Bitcoin’s hash rate in May that year. The breach reportedly occurred on December 28, 2020, when over 90% of the pool’s Bitcoin holdings were drained. Additional funds, including BTC and USDT on the Omni layer, were stolen the following day.
Arkham confirmed that neither the LuBian team nor the hacker acknowledged the breach publicly. Despite the magnitude of the theft, no official disclosure had been made before Arkham’s report surfaced. The analysis suggests this was not a random brute-force event but a targeted exploitation of a known vulnerability.
Vulnerability in Key Generation May Have Enabled Access
Arkham’s findings indicate that LuBian may have used a private key generation algorithm that was susceptible to brute-force attacks. This security weakness appears to have been the point of entry for the hacker who managed to bypass protections and extract funds.
Evidence from the blockchain shows LuBian attempted to contact the hacker. They sent an OP_RETURN message to each hacker address, pleading for the return of stolen funds. In total, 1.4 BTC was spent across 1,516 transactions to deliver these messages.
The transaction pattern and timing suggest the messages were genuine and originated from LuBian. This reduces the possibility of interference or spoofing by unrelated parties. It also implies that LuBian did not regain access to its compromised wallets, reinforcing the seriousness of the breach.
Despite the losses, LuBian was able to safeguard 11,886 BTC by rotating remaining funds into recovery wallets on December 31, 2020. These funds, valued at $1.35 billion today, remain under LuBian’s control.
Hacker Still Holds Funds; Now One of Bitcoin’s Largest Holders
The stolen BTC is still with the hacker, the last activity that we recorded was in July 2024. At that time, the funds were aggregated across wallets, which shows that the original hacker still had access and control.
The dramatic price rise of Bitcoin since 2020 has elevated the value of the stolen assets to $14.5 billion. Based on Arkham’s wallet tracking, this places the LuBian hacker as the 13th largest BTC holder. This position is now ahead of the Mt. Gox hacker, previously known for one of the industry’s largest exploits.
The attacker’s wallet addresses have not shown any liquidation activity since the last movement. Arkham has not disclosed the hacker’s identity but is the first entity to publicly connect the event to LuBian and trace the BTC holdings.
This revelation marks a turning point in a long-unsolved mystery. LuBian’s case sets a new record as the largest confirmed crypto theft in history.
