LuBian Pool Bitcoin Theft Analysis: National Level Hacker Group Orchestrates "Hack on Hack" Event

On November 9th, the National Computer Virus Emergency Response Center issued the "LuBian Mining Pool Hacked, Massive Bitcoin Theft Incident Technical Traceability Analysis Report." On December 29, 2020, a significant hack took place at the LuBian mining pool, with a total of 127,272.06953176 bitcoins being stolen (valued at approximately $3.5 billion at that time and now with a market value of $15 billion). The owner of these massive bitcoins is none other than Chen Zhi, the Chairman of the Cambodian Crown Prince Group. After the hack, Chen Zhi and his Crown Prince Group posted messages on the blockchain in early 2021 and July 2022, calling out to the hacker, expressing the hope that the stolen bitcoins would be returned and indicating their willingness to pay a ransom, but they received no response. Surprisingly, after the massive bitcoin theft, the bitcoins remained dormant in the hacker-controlled bitcoin wallet address for a long period of 4 years and were almost untouched. This behavior clearly does not match the typical hacker's rush to cash out for profit; rather, it seems more like a precise operation carried out by a "state-level hacker organization." It was not until June 2024 that these stolen bitcoins were moved to a new bitcoin wallet address and have remained untouched since. On October 14, 2025, the U.S. Department of Justice announced criminal charges against Chen Zhi and stated that 127,000 bitcoins had been seized from Chen Zhi and his Crown Prince Group. Various pieces of evidence indicate that the massive bitcoins seized by the U.S. government from Chen Zhi and his Crown Prince Group were actually the LuBian mining pool bitcoins that had been stolen by hackers using technical means as early as 2020. In other words, the U.S. government had already utilized hacker techniques to seize the 127,000 bitcoins held by Chen Zhi back in 2020 in a typical "hack-on-hack" event orchestrated by a state-level hacker organization.