LuBian Hack: $1.83 Billion in Stolen Bitcoin Moves, Signaling New Phase of Crypto's Biggest Heist

The Echoes of a Monumental Heist: 15,959 Bitcoin on the Move

A staggering sum of 15,959 Bitcoin, currently valued at a colossal $1.83 billion, has been transferred from wallets historically linked to the infamous LuBian hacker group. This significant movement of funds marks a potentially new and concerning phase in what is widely regarded as the most extensive cryptocurrency theft ever recorded. These digital assets, once pilfered from the LuBian mining pool back in 2020, represent a fraction of the original haul, which saw hackers abscond with a mind-boggling 127,426 Bitcoin, estimated to be worth over $3.5 billion at the time.

A Strategic Dispersion: Not Just a Dump

Blockchain analytics firm OnchainLens has meticulously tracked this latest development, highlighting that the hackers' strategy wasn't a simple, brute-force transfer to a single destination. Instead, the Bitcoin was strategically divided among four newly established, dedicated addresses. The allocation was precise: two transfers comprised 4,999 BTC each, while the remaining two were for 3,424 BTC and 2,535 BTC respectively. This calculated distribution strongly suggests a deliberate preparation for further maneuvers, potentially aimed at obscuring the trail or facilitating a more complex liquidation process.

From $3.5 Billion to Over $14.5 Billion: The Escalating Shadow of LuBian

The original LuBian hack, which occurred in December 2020, initially seemed like a devastating blow. However, the subsequent meteoric rise of Bitcoin's value has transformed the scale of this crime. The stolen 127,000+ Bitcoin, once valued at around $3.5 billion, now commands an astronomical market value exceeding $14.5 billion. This dramatic revaluation solidifies the LuBian incident as the undisputed champion of crypto heists, dwarfing historical events like the Mt. Gox hack in terms of sheer fiat equivalent, even if the latter was a significant event in its own time.

Whispers of Liquidation and the Shadow of Prince Group

For years following the theft, the compromised wallets remained largely dormant, like a sleeping dragon guarding its hoard. This recent activity, however, sends a clear signal: the perpetrators may be gearing up for the final act – the liquidation or, more disturbingly, the laundering of these illicit gains. The possibility of utilizing decentralized platforms or sophisticated mixers to obscure the origin of these funds is a significant concern for blockchain investigators. Adding a chilling layer to this saga, investigations in 2021 and 2022 revealed critical security vulnerabilities within LuBian, particularly regarding poorly structured private key management, which regrettably paved the way for the hackers' seamless intrusion. Intriguingly, some specialists from Arkham Intelligence and Elliptic have even posited the theory that the theft itself might have been an elaborate fabrication. Further complicating the narrative, the U.S. government, on October 14, 2025, announced its intention to seize these very funds, linking them to an ongoing investigation into the Prince Group, a criminal organization operating out of Cambodia and reportedly involved in forced labor camps. The U.S. Department of Justice has explicitly tied the mining pool to money laundering activities benefiting this group. Yet, despite these revelations, the identities of the masterminds behind the original attack remain publicly undisclosed.

The Watch Continues: Future Implications

As of now, the four newly activated Bitcoin addresses remain quiescent, showing no further transactional activity. However, seasoned analysts are on high alert, anticipating future interactions with cryptocurrency exchanges or decentralized services. The digital breadcrumbs left by this colossal heist are being meticulously followed, and the world will undoubtedly be watching these addresses closely as the story of the LuBian theft continues to unfold.