Blockchain intelligence firm Arkham Intelligence uncovered a theft of 127,426 BTC from LuBian, a Chinese Bitcoin mining pool. The breach occurred in December 2020 and remained undisclosed for years. At the time of the hack, the stolen Bitcoin was valued at $3.5 billion. Following Bitcoin’s price surge, those assets are now worth $14.5 billion, making it the biggest crypto hack ever recorded.
LuBian ran mining facilities in China and Iran, controlling nearly 6% of Bitcoin’s total hash rate in 2020. Arkham’s on-chain analysis showed that hackers drained over 90% of LuBian’s Bitcoin holdings on December 28, 2020. Two days later, they removed additional funds from a Bitcoin Omni Layer address linked to the mining pool.
Neither LuBian nor the hacker disclosed the breach publicly. The stolen Bitcoin stayed untouched for years, remaining unnoticed until Arkham traced its activity.
Dormant Bitcoin Wallets Confirm LuBian Hack
Arkham’s research identified several addresses connected to the stolen Bitcoin. These addresses received OP_RETURN messages from LuBian. This function records data on the blockchain and was used by LuBian to request the return of the stolen funds.
The mining pool spent 1.4 BTC across 1,516 transactions sending these OP_RETURN messages. The repeated appeals confirmed LuBian’s link to the addresses and validated the breach.
In July 2024, Arkham detected a consolidation of the stolen Bitcoin into fewer wallets. Since then, the hacker has not moved any of the funds. The 127,426 BTC remain in dormant wallets, placing the hacker among the 13 largest Bitcoin holders worldwide.
LuBian Exploit Tied to Weak Key Generation
Arkham attributed the theft to a flawed key generation algorithm used by LuBian. This issue may have exposed the mining pool’s private keys to brute-force attacks, allowing unauthorized access to its Bitcoin wallets.
LuBian still holds about 11,886 BTC, currently valued at $1.35 billion, showing the mining pool continued its operations after the hack despite the significant loss.
Arkham’s findings highlight that over 90% of LuBian’s Bitcoin holdings were stolen in a single incident, emphasizing the scale of the breach.
Arkham’s Data Shows Largest Crypto Hack on Record
This disclosure surpasses the previous record set by the $1.5 billion Bybit hack in February 2025. Arkham linked multiple addresses involved in the theft and confirmed each received on-chain messages directly from LuBian.
The stolen Bitcoin has remained untouched for nearly five years after the hack. Arkham’s data-driven investigation clearly showed how the theft occurred and where the funds are currently held.
As a result, Arkham’s analysis identified this incident as the largest crypto hack ever, involving 127,426 BTC worth $14.5 billion and impacting one of the major Bitcoin mining pools of that period.
