Lubian hacker moves billion in BTC as US gov looks to forfeit funds

Right after the US government announced its historic plans to forfeit around $14 billion in bitcoin (BTC), the hacker of the LuBian mining pool woke up and rushed to move funds to new addresses.

Blockchain analysts caught the hacker first, moving 9,757 BTC ($1.08 billion) to two new wallets, and soon after sending another 2,129 BTC ($237 million). This was the first time these funds, tied to the hack of the bitcoin mining pool LuBian, had moved in three years.

This dormant wallet woke up right after the US Department of Justice said it had filed a forfeiture complaint against approximately 127,271 BTC ($14 billion) confiscated from Chen Zhi, also known as "Vincent," the suspected mastermind of an Asian scam network who was also behind LuBian.

Blockchain analysis company Elliptic claims that these BTC were “stolen” in 2020 from LuBian, a now-defunct bitcoin mining business with operations in China and Iran.

“The indictment lists 25 bitcoin addresses, which it states the seized bitcoins were previously held. These bitcoin addresses are the LuBian addresses (controlled by Chen) from which bitcoins were ‘stolen,’” the analysts said, adding that it’s unclear who “stole” the BTC from Chen/LuBian, or whether a theft really took place.

“If it did, it seems likely that an opportunistic hacker saw the opportunity to take LuBian's bitcoins before coming to the attention of the US government,” Elliptic concluded.

According to US law enforcement, Chen Zhi and his co-conspirators laundered money by using it to fund large-scale cryptocurrency mining operations, including LuBian, which for some time was the sixth-largest bitcoin mining operation in the world.

As reported by Cybernews.com, Arkham Intelligence discovered that the mining pool lost 127,426 BTC in an apparent hack in December 2020, forcing the company to shut down soon after. However, at least until July 2024, LuBian’s team was still trying to recover the lost money and even spent 1.4 BTC to send messages via the bitcoin blockchain to the hacker, asking the owner of the BTC address to contact the team and discuss “the return of assets and your reward.”

Unlock more exclusive Cybernews content on YouTube.