A major security incident struck the Bitcoin mining sector as approximately 64,000 mining machines were hijacked and their computing power redirected to the OCEAN mining pool. This attack caused a sudden spike in OCEAN’s hashrate, which briefly reached nearly 50 exahashes per second (EH/s), before settling closer to 40 EH/s as the situation evolved.
Attack timeline and initial detection
According to Wu Blockchain, the attack began at around 8 p.m. U.S. Central Time on November 14. Almost immediately, CoreX Hosting, a company providing infrastructure services to mining operators, detected unauthorized modifications in mining pool settings across multiple clients.
The attackers redirected 13 EH/s of computing power from the compromised mining machines to OCEAN, a mining pool that has recently gained visibility in the Bitcoin ecosystem. They also altered mining payout addresses to a Bitcoin address under their control, in an apparent attempt to capture potential rewards.
CoreX Hosting alerted clients and the broader community after detecting sudden and widespread changes in system configurations. The company reported that several mining farms noticed unauthorized re-routing of their hashing power during the attack period.
Data from OCEAN’s dashboard indicated a sharp increase in the pool’s hashrate following the incident, peaking at 49.9 EH/s before gradually declining as affected operators regained control of their mining hardware.
Impact on OCEAN and affected miners
The sudden inflow of redirected hashing power caused OCEAN’s total hashrate to surge from typical levels to nearly 50 EH/s. However, this increase did not reflect growth in the overall Bitcoin network, but instead a temporary reallocation from other pools.
Blockchain explorers confirmed that, despite gaining control of considerable infrastructure, the attackers failed to mine any new Bitcoin blocks during the incident. As a result, they received no block rewards despite their efforts to redirect payouts to their chosen address. Nevertheless, affected mining operators lost potential revenue as their equipment was diverted away from their preferred mining pools for an extended period.
CoreX Hosting later stated that the attack appeared to subside on November 15, with the compromised hashrate dropping from approximately 13 EH/s to just 100 petahashes per second (PH/s), representing over a 99% reduction.
Source and scale of the security breach
One operator whose facility was compromised pointed to Luxor’s Commander mining management software as a likely attack vector. Luxor Technologies is a provider of software and infrastructure solutions for Bitcoin mining, serving a wide range of industry participants.
Other operators said they experienced similar unauthorized changes in mining pool configurations in the days leading up to the major incident. These developments raised concerns that the underlying vulnerability might extend beyond the originally identified farms, although security researchers have yet to independently verify the full scope or establish a definitive link to Luxor Commander.
Mini dictionary: Luxor Commander is a mining management software platform developed by Luxor Technologies, designed to allow fleet-wide monitoring, configuration, and management of large-scale cryptocurrency mining operations.
Uncertain losses and ongoing investigation
While the attack did not result in block rewards for the perpetrators, the affected miners lost valuable hashing hours which otherwise could have generated income. The precise financial impact and the total number of mining facilities impacted have not been published. Industry participants continue to review their systems for lingering vulnerabilities and to assess whether additional mitigations are needed.
