$3.5 Billion Bitcoin Heist at LuBian Went Unnoticed for Almost Five Years, According to Arkham

New findings from Arkham Intelligence suggest that a crypto wallet linked to a relatively unknown Chinese mining pool may have fallen victim to the largest recorded bitcoin theft. In a recent thread, the on-chain analytics firm revealed that it discovered evidence of the theft of 127,426 BTC, valued at $3.5 billion at the time, from LuBian Mining Pool in late December 2020. The breach was never publicly acknowledged by LuBian or the suspected hacker, and Arkham is the first to report the incident.

At its peak in 2020, LuBian was one of the largest bitcoin mining pools globally, controlling nearly 6% of Bitcoin's total hash rate. If confirmed, the hack would surpass the scale of other high-profile exploits like Mt. Gox and Bitfinex in terms of nominal value at the time of loss.

According to Arkham's analysis, over 90% of LuBian's BTC holdings were drained on December 28, 2020. Two days later, another theft occurred, involving approximately $6 million worth of BTC and USDT, linked to a LuBian address on the Bitcoin Omni layer. The company appears to have transferred its remaining 11,886 BTC into recovery wallets by December 31, 2020. A notable aspect of Arkham's report is the presence of OP_RETURN messages, special transactions that allow data to be embedded in the Bitcoin blockchain, sent from LuBian to the hacker.

The mining pool spent 1.4 BTC across over 1,500 transactions attempting to contact the thief and urging them to return the stolen funds. This effort suggests that the messages were genuine and originated from the rightful wallet owner.

Arkham believes that the vulnerability may have resulted from LuBian's use of a flawed private key generation algorithm, leaving it susceptible to brute-force attacks. The stolen BTC has largely remained dormant, with the last major movement being a wallet consolidation in July 2024. Due to the appreciation of bitcoin's price since 2020, the current value of the stolen assets is estimated to be $14.5 billion, making the wallet associated with the LuBian hacker the 13th largest BTC holder tracked by Arkham. As of today, both the hacker and LuBian are believed to still control their respective BTC balances, with Arkham publishing wallet trackers for both parties, but no additional details about the identities involved have been disclosed.