LuBian Pool Bitcoin Theft Analysis: National Level Hacker Group Orchestrates "Hack on Hack" Event

2025.11.09 18:56:31

On November 9th, the National Computer Virus Emergency Response Center issued the "LuBian Mining Pool Hacked, Massive Bitcoin Theft Incident Technical Traceability Analysis Report." On December 29, 2020, a significant hack took place at the LuBian mining pool, with a total of 127,272.06953176 bitcoins being stolen (valued at approximately $3.5 billion at that time and now with a market value of $15 billion). The owner of these massive bitcoins is none other than Chen Zhi, the Chairman of the Cambodian Crown Prince Group. After the hack, Chen Zhi and his Crown Prince Group posted messages on the blockchain in early 2021 and July 2022, calling out to the hacker, expressing the hope that the stolen bitcoins would be returned and indicating their willingness to pay a ransom, but they received no response. Surprisingly, after the massive bitcoin theft, the bitcoins remained dormant in the hacker-controlled bitcoin wallet address for a long period of 4 years and were almost untouched. This behavior clearly does not match the typical hacker's rush to cash out for profit; rather, it seems more like a precise operation carried out by a "state-level hacker organization." It was not until June 2024 that these stolen bitcoins were moved to a new bitcoin wallet address and have remained untouched since. On October 14, 2025, the U.S. Department of Justice announced criminal charges against Chen Zhi and stated that 127,000 bitcoins had been seized from Chen Zhi and his Crown Prince Group. Various pieces of evidence indicate that the massive bitcoins seized by the U.S. government from Chen Zhi and his Crown Prince Group were actually the LuBian mining pool bitcoins that had been stolen by hackers using technical means as early as 2020. In other words, the U.S. government had already utilized hacker techniques to seize the 127,000 bitcoins held by Chen Zhi back in 2020 in a typical "hack-on-hack" event orchestrated by a state-level hacker organization.

Add to Favorites Download image Share x Copy link

Relevant content

Analysis: Bitcoin’s ADX trend strength drops to a more than two-year low, signals of returning volatility strengthen, and a directional choice is imminent.

CryptoQuant analyst Darkfost noted in a post that Bitcoin’s Average Directional Index (ADX) indicator hit its lowest level in over two years today, another signal suggesting volatility is about to return. ADX is a tool for measuring trend strength, not directional, carrying no bullish connotation—it is only used to track trend strength rather than price action. An extremely low ADX level means Bitcoin has been trading sideways in a range for quite a long time, trend momentum is nearly exhausted, and prices will have to choose a direction soon. Darkfost stressed that multiple indicators currently point to the same conclusion: the market has been in a "hypnotic" low-volatility state for several consecutive months, major swings are imminent, and investors should remain highly vigilant.

7 minutes ago

Upbit will delist JASMY, TT, and STORJ on September 14.

South Korea’s largest cryptocurrency exchange Upbit will halt trading support for the following tokens starting September 14: Jasmy (JASMY), ThunderCore (TT), and STORJ.

7 minutes ago

Analysis: 41.5% of BTC purchased in 2025 have been sold at a loss, with holding turnover approaching levels seen during the past two bear markets.

On-chain analyst Murphy noted that all BTC purchased in 2025 is currently in a loss position. Whenever the volume of these 2025-acquired BTC decreases, all reductions (excluding wallet transfers) stem from selling at a loss. As of now, 4.77 million BTC bought in 2025 remain, a 41.5% drop from their peak last December. The downward trend’s slope has two distinct phases: a sharp decline before February this year, followed by a slowdown after February, though it still maintains a notable downward slope. This cohort represents the largest supply side in the current market. Comparing data from 2022 to 2024, it’s clear that holdings with unrealized profits have largely passed the steep phase of decline. Even if prices drop further, changes in the volume of these holdings will no longer be significant. In other words, the potential supply from this group has already completed its turnover. Looking at the past two bear markets: during the 2022 bear market bottom, holdings from the 2021 peak dropped by 51%; during the 2018 bear market bottom, holdings from the 2017 peak fell by 62%. Murphy estimates that the current bear market bottom will see a maximum decline of 50-60%, with the current figure standing at 41%.

7 minutes ago

Bitcoin falls below $63,000, with a 1.5% decline in the past 24 hours.

According to HTX market data, Bitcoin has fallen below $63,000, recording a 1.5% decline in the past 24 hours.

7 minutes ago

Binance will stop supporting SOPH deposits and withdrawals via BNB Smart Chain.