A previously undisclosed theft of 127,000 Bitcoin, worth $3.5 billion at the time, has been traced back to the sudden 2020 disappearance of Chinese mining pool Lubian, according to new data from blockchain analytics firm Arkham.
The hack, which Arkham says occurred on December 28, 2020, is now believed to be the largest crypto theft in history, far surpassing the $1.5 billion Bybit exploit that occurred in February.
Despite draining nearly all of Lubian’s holdings, the incident went entirely unreported for over four years, and neither the mining pool nor the hacker has ever acknowledged the breach.
Lubian was a top-10 mining pool at its peak, responsible for nearly 6% of global Bitcoin hash rate in mid-2020.
But the pool mysteriously stopped mining in early 2021.
At the time, observers chalked it up to regulatory pressure in China and Iran, where Lubian’s machines were reportedly located.
Arkham now suggests the shutdown was the direct result of a catastrophic breach, likely enabled by weak private key generation vulnerable to brute-force attacks.
As a last-ditch attempt, Lubian sent over 1,500 small Bitcoin transactions that included messages asking for the stolen funds to be returned. The pool also rotated what remained of its Bitcoin — roughly 11,880 coins — into recovery wallets.
The hacker has yet to move the stolen coins beyond a 2024 consolidation.
The revelation comes amid a historic surge in crypto-related thefts.
In the first half of 2025 alone, hackers stole more than $3.1 billion across web3 platforms, with $1.83 billion tied to so-called access control attacks, according to Hacken’s H1 security report.
These exploits often involve compromised infrastructure or admin credentials, and increasingly bypass traditional safeguards like multi-signature wallets.
With the stolen Bitcoin now worth over $14.5 billion, the attacker ranks among the largest Bitcoin holders in the world, ahead of the Mt. Gox hacker and several nation-state treasuries.
Kyle Baird is DL News’ Weekend Editor. Got a tip? Email at kbaird@dlnews.com.
