- Arkham revealed the LuBian hack for the first time, exposing a theft of 127,426 BTC that remained hidden for nearly four years.
- The breach was linked to poor key generation systems vulnerable to brute-force attacks, especially tied to a 32-bit entropy flaw.
- The stolen Bitcoin now makes the unidentified hacker one of the largest BTC holders globally, ahead of known cybercriminals.
Blockchain analytics firm Arkham has revealed details of the largest Bitcoin theft in history. The breach, previously unknown to the public, involved the theft of 127,426 BTC from the China-based LuBian mining pool in late 2020. The stolen funds, now valued at over $14.5 billion, went unnoticed for years.
According to Arkham’s investigation, the attacker exploited LuBian’s weak private key algorithms. These keys were vulnerable to brute-force methods. The breach was likely made possible through flawed entropy generation, particularly a 32-bit entropy model seen in past wallet breaches, including Trust Wallet-based systems.
Neither LuBian nor the attacker disclosed the breach at the time. On-chain records show the first major transfer occurred on December 28, 2020. Another $6 million in Bitcoin vanished the following day. LuBian later attempted to reach the hacker using the Bitcoin network’s OP_RETURN function, sending 1.4 BTC in 1,516 messages with a plea for fund return and a reward offer.
LuBian lost over 90% of its Bitcoin, retaining 11,886 BTC
Arkham’s data indicates that more than 90 percent of LuBian’s holdings were drained in a short period. Despite the breach, the mining pool preserved around 11,886 BTC, currently valued at approximately $1.35 billion. The hacker’s address now ranks as the 13th largest Bitcoin holder tracked by Arkham, placing it ahead of the Mt. Gox hacker.
Before this revelation, the Bybit exploit was considered the largest crypto theft, with losses exceeding $1.4 billion in Ethereum. The silent LuBian breach, both in scale and secrecy, has now overtaken that incident in magnitude. Arkham’s visual analysis traced the flow of stolen funds through hundreds of wallets, highlighting the calculated nature of the operation.
At the time of the breach, LuBian operated from China and Iran and accounted for nearly 6 percent of Bitcoin’s global hash rate. The platform was one of the most active mining pools in the network during 2020.
