Blockchain analytics firm Arkham Intelligence has revealed proof of the largest Bitcoin theft in history. Their investigation confirms Chinese Bitcoin mining pool LuBian suffered a devastating hack in December 2020.
Hackers stole 127,426 Bitcoin from LuBian in this massive cryptocurrency breach.
- Value at Time of Theft (Dec 2020): ~$3.5 Billion
- Current Value (Aug 2025): ~$14.5 Billion
The heist unfolded with surgical precision according to Arkham's forensic report. On December 28, 2020, attackers drained 90% of LuBian's Bitcoin reserves in a single transaction. Two days later, they siphoned another $6 million in crypto assets. Security experts attribute the breach to critical flaws in LuBian's private key generation system, which enabled brute-force exploitation of wallet vulnerabilities.
Track the $14.5B LuBian Bitcoin heist in real-time:
LuBian Hacker Wallet Dashboard (Arkham)
What makes this case extraordinary is its five-year concealment. Neither LuBian nor the hacker publicly acknowledged the theft until Arkham's blockchain tracing uncovered the transaction patterns. The mining pool's only response was a desperate campaign embedded in Bitcoin's blockchain: 1,516 transactions spending 1.4 BTC to broadcast pleading messages for the funds return.
The anonymous perpetrator now ranks as the world's 13th-largest Bitcoin holder according to Arkham's entity dashboard, surpassing even the infamous Mt. Gox hacker. This dormant $14.5 billion cache represents a potential market earthquake, its movement could trigger severe volatility in Bitcoin's liquidity.
Industry analysts note this breach dwarfs recent incidents like Bybit's 2025 $1.5 billion hack and highlights persistent security failures in early crypto infrastructure. LuBian, which commanded 6% of Bitcoin's global mining power before vanishing from prominence, never implemented fundamental safeguards like multi-signature wallets or hardware-secured key generation.
Regulatory bodies are expected to leverage this case to accelerate enforcement of strict custody rules under frameworks like the EU's MiCA legislation. Meanwhile, the hacker's July 2024 consolidation of stolen funds into a single wallet suggests potential preparation for future movement - placing markets on high alert for possible sell-pressure events.
Lazarus Group hacks timeline - Read Here