TLDR:
- About 64,000 Bitcoin mining machines were reportedly hijacked as attackers redirected 13 EH/s to OCEAN.
- OCEAN’s mining pool briefly approached 50 EH/s after attackers redirected computing power from other pools.
- CoreX Hosting said the attack appeared to end as the diverted Bitcoin hashrate fell from 13 EH/s to 100 PH/s.
- Attackers mined no blocks during the incident, while the suspected Luxor Commander breach remains unverified.
Approximately 64,000 Bitcoin mining machines were reportedly hijacked after attackers redirected 13 exahashes per second (EH/s) of computing power to the OCEAN mining pool. The attackers also changed the mining payout address to a Bitcoin address under their control, although they failed to collect any block rewards during the incident.
According to Wu Blockchain, the attack began at approximately 8 p.m. U.S. Central Time on November 14. Mining infrastructure provider CoreX Hosting subsequently raised the alarm after detecting unauthorized changes to mining pool configurations.
Bitcoin Mining Hijack Pushes OCEAN Hashrate Near 50 EH/s
Data from OCEAN’s mining dashboard showed a sudden increase in computing power as the attackers redirected the compromised machines to the pool. Its hashrate briefly approached 50 EH/s before retreating toward 40 EH/s.
The dashboard subsequently displayed a hashrate of 41.59 EH/s. However, the increase reflected redirected computing power rather than an equivalent expansion in Bitcoin’s overall mining capacity.
The attackers attempted to monetize the compromised infrastructure by directing potential mining rewards to their own Bitcoin address. Consequently, affected operators lost the opportunity to generate revenue through their intended mining pools while their machines continued operating.
CoreX Hosting later reported that the attack appeared to have ended on November 15. The hijacked computing power dropped from approximately 13 EH/s to 100 petahashes per second (PH/s), representing a reduction of more than 99%.
Suspected Luxor Commander Breach Raises Mining Security Questions
One affected mining operator reported that their entire mining farm had been hijacked and identified Luxor’s Commander mining management software as the suspected source of the compromise. Meanwhile, other mining operators reported similar unauthorized changes to their pool configurations several days before the latest incident.
Those accounts raised questions about whether the security breach extended beyond the machines identified in the initial reports. However, neither the full extent of the attack nor the alleged compromise of Luxor Commander has received independent confirmation.
Bitcoin Miners Lose Revenue as Attackers Fail to Mine Blocks
Despite gaining control of substantial computing resources, the attackers reportedly failed to mine a Bitcoin block during the incident. As a result, they received no block rewards during the reported attack period.
Affected mining operators nevertheless lost valuable hashing time that could have generated revenue through their original pools. Unlike temporarily redirected computing power, the lost mining time cannot be recovered. The available reports did not quantify the financial losses or establish the total number of affected mining facilities.
