LuBian Hack
Reported loss
$3.5B
Private Key Compromised (Brute Force)
What happened
On December 28, 2020, LuBian, a Chinese Bitcoin mining pool, appears to have lost 127,426 BTC, valued by Arkham at approximately $3.5 billion at the time. Arkham's 2025 on-chain investigation says the theft was not publicly acknowledged and assesses that LuBian's private-key generation algorithm may have been susceptible to brute-force attacks.
How it happened
- Arkham's on-chain analysis identifies the first theft on December 28, 2020 as taking more than 90% of LuBian's BTC.
- Arkham assesses that a private-key generation algorithm susceptible to brute force may have allowed the attacker to control the affected wallet keys.
- On December 29, additional BTC and USDT were taken from a LuBian Omni-layer address.
- LuBian rotated its remaining funds to recovery wallets on December 31 and sent OP_RETURN messages asking the attacker to return the funds.
Protocol details
Classification
Infrastructure / Key Compromise
Protocol Type
Other
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
