Attackers hijack about 64,000 Bitcoin miners and point 13 EH/s at OCEAN

The attackers didn't earn anything for their trouble. No blocks were mined, and their payout address received no payments. The miners whose machines were hijacked weren't so lucky: their lost revenue is gone for good.

Attack Unfolds

The incident began at approximately 8 p.m. Central Time. It showed up fast in public data, because OCEAN's reported hashrate jumped sharply. The pool's hashrate climbed to approximately 50 EH/s, then settled at around 40 EH/s.

The surge didn't last. The diverted power later fell to about 100 PH/s. A petahash is one-thousandth of an exahash, so most of the hijacked machines had been pulled back within a short window.

Software Vulnerability Suspected

Operators first learned about the problem from CoreX Hosting. The hosting firm spotted unauthorized changes to pool settings on the affected machines. One operator said their entire mining operation was hit.

Revenue Impact

Every minute those machines worked for the attackers was a minute they weren't earning for their owners' pools. That revenue can't be clawed back. Mining income depends on contributing work in real time, and once that time passes, the opportunity is gone.

What's Next

For mining operators, the most immediate question is the entry point. If Luxor Commander is confirmed as the vulnerability, anyone running it will want to know what was exposed and whether a fix is available. Until that is clear, operators may want to audit their pool settings frequently.

The earlier reports of unauthorized pool changes deserve attention too. If attackers were probing access in the days before the main event, the November 14 incident may not mark the end of it.