Onchain analytics firm Arkham Intelligence revealed that a massive theft of 127,426 bitcoin (BTC) from the Chinese mining pool LuBian, worth $3.5 billion at the time, was perpetrated in December 2020, calling it the “largest theft in history.”
Currently, the stolen funds amount to approximately $14.5 billion due to the rise in the price of Bitcoin over the past five years. According to Arkham, neither LuBian nor the alleged hacker have publicly acknowledged the incident, marking the first time the case has been made public.
The LuBian hacker is the 13th largest BTC holder in Arkham. Source: Arkham Intelligence.
Arkham's analysis details that LuBian, which operated facilities in China and Iran and controlled nearly 6% of the Bitcoin network's hash rate in May 2020, suffered its first attack on December 28, 2020, losing over 90% of its BTC.
The following day, on December 29, the attackers extracted an additional $6 million in BTC and the stablecoin USDT from LuBian's active Bitcoin Omni Layer address. By December 31, LuBian moved its remaining 11,886 BTC, currently valued at $1.35 billion, to recovery wallets, a mechanism that involves moving funds to secure addresses to protect them from future attacks.
Additionally, LuBian attempted to contact the hacker using OP_RETURN messages, a Bitcoin network feature that allows small pieces of information to be included in transactions. In these messages, the pool requested a return of the funds. Arkham notes that LuBian spent 1.4 BTC in 1,516 transactions to send these messages, the amount and cost of which could indicate the authenticity of these messages and that they were not forged by another attacker.
The vulnerability that led to the theft, according to Arkham, could be related to a weak algorithm used by LuBian to generate its private keys, which is susceptible to brute-force attacks. However, the pool has not yet commented on the matter.
For his part, the hacker still retains the stolen BTC, with his last recorded activity in July 2024, when he consolidated his funds into new wallets. Currently valued at $14.5 billion, the theft makes the LuBian hacker the 13th largest holder of BTC, according to Arkham.
Before this incident, the most significant theft was that of the Bybit exchange in February 2025, when 401,346 ETH, equivalent to $1.4 billion at current prices, was stolen from a multi-signature cold wallet. Prior to Bybit, in 2022, Ronin Chain suffered an exploit that resulted in the loss of 173,600 ETH, with a current value of $600 million.
