Approximately 64,000 Bitcoin mining rigs had their computing power hijacked, and the attackers failed to successfully mine blocks to obtain profits.

Approximately 64,000 Bitcoin mining rigs were hijacked, with a combined hashrate of around 13 EH/s. Attackers redirected the rigs’ hashrate to the OCEAN mining pool and set the payout address to a Bitcoin wallet under their control. The attack reportedly began around 20:00 Central Time (10:00 Beijing Time) on November 14. OCEAN’s dashboard showed its hashrate spiking sharply in a short window, nearly hitting 50 EH/s before falling back to around 40 EH/s. Mining hosting provider CoreX Hosting was the first to issue an alert, noting some rigs were unauthorizedly switched to other pools. An affected mine operator said their entire facility was hijacked, pointing to Luxor’s Commander mining management software as a potential root cause of the security incident. Other operators reported similar unauthorized pool-switching incidents several days earlier, suggesting the attack may be more widespread. CoreX later stated the attack appeared to have concluded, with the hijacked hashrate dropping from 13 EH/s to roughly 100 PH/s. The attackers failed to mine any Bitcoin blocks during the hijacking, so they earned no block rewards. However, affected miners permanently lost the Bitcoin mining revenue they would have generated during the attack, as this hashrate time is irrecoverable. To date, the full scope of the incident and whether Luxor Commander was compromised have not been independently verified.