One of the world’s largest Bitcoin mining operations, LuBian, fell victim to a sophisticated multi-stage cyberattack in late December 2020, resulting in the theft of over 90% of its Bitcoin holdings plus an additional $6 million in cryptocurrency assets.
The breach highlighted critical security vulnerabilities in major mining pool infrastructure, sending shockwaves through the cryptocurrency mining community and raising questions about custodial security practices among large-scale operations.
Initial Breach Compromises Core Bitcoin Holdings
The first attack occurred on December 28, 2020, when hackers successfully infiltrated LuBian’s hot wallet infrastructure and extracted the majority of the mining pool’s Bitcoin reserves.
LuBian had been controlling approximately 6% of the Bitcoin network’s total hash rate as of May 2020, making it a significant player in the mining ecosystem with substantial cryptocurrency holdings under management.
The attackers demonstrated sophisticated knowledge of LuBian’s wallet architecture, suggesting either insider involvement or extensive reconnaissance of the mining pool’s operational security protocols.
The breach utilized advanced techniques to bypass multi-signature requirements and exploit vulnerabilities in the pool’s automated payout systems.
Mining pool operations typically maintain hot wallets for frequent transactions and cold storage for long-term holdings, but the attack appeared to compromise multiple layers of their security infrastructure.
Secondary Attack Targets Omni Layer Assets
Just 24 hours after the initial breach, on December 29, the attackers struck again, this time targeting approximately $6 million worth of Bitcoin and Tether (USDT) held in a LuBian-controlled address operating on the Bitcoin Omni layer protocol.
The Omni layer represents a communications protocol built on top of the Bitcoin blockchain, enabling the creation and trading of custom digital assets and currencies.
This secondary attack demonstrated the hackers’ comprehensive understanding of LuBian’s multi-protocol asset management strategy.
The theft involved manipulating Omni layer transactions, which require specific technical knowledge of both Bitcoin’s UTXO model and Omni’s overlay protocol specifications.
Transaction analysis revealed that the attackers used sophisticated mixing techniques and multiple intermediate addresses to obfuscate the stolen funds’ movement.
On December 31, LuBian management initiated emergency protocols, rotating their remaining cryptocurrency holdings to newly-generated recovery wallets with enhanced security measures.
The incident prompted industry-wide discussions about improved custodial practices, multi-signature implementations, and the need for more robust security frameworks in cryptocurrency mining operations.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=The breach highlighted critical security vulnerabilities in major mining pool infrastructure, sending shockwaves through the cryptocurrency mining community){kind=link}