TLDR
- 15,959 BTC worth $1.83B from the LuBian hack was moved to four wallets.
- The 2020 LuBian theft involved 127,426 BTC, now worth around $14.5B.
- Two transfers of 4,999 BTC were part of the four-way wallet split.
- The LuBian hack remains one of the largest crypto thefts by value.
Wallets linked to a major 2020 crypto theft have moved nearly $1.83 billion worth of bitcoin in one coordinated transaction. According to blockchain tracking platform OnchainLens, hackers transferred 15,959 BTC—part of a much larger haul stolen from the Chinese mining pool LuBian—into four separate addresses. The transfers have sparked fresh scrutiny from analysts and law enforcement as they track any movement towards exchanges or laundering platforms.
Large Bitcoin Movement Traced to LuBian Theft
On October 22, 2025, onchain analysts reported that 15,959 BTC tied to the LuBian mining pool hack were sent to four new addresses. The bitcoin involved is valued at over $1.83 billion based on current market prices.
OnchainLens, using Arkham Intelligence data, shared that the transfers were broken into four transactions. Two transfers involved 4,999 BTC each, while the other two sent 3,424 BTC and 2,535 BTC. These movements suggest that the stolen funds are still being managed in bulk by one or more coordinated parties.
LuBian, a once little-known mining pool based in China, was compromised in December 2020. Hackers took control of wallets holding a total of 127,426 BTC. At the time, the stolen amount was worth about $3.5 billion. As of today, it is valued close to $14.5 billion.
Onchain Activity Signals Renewed Movement of Dormant Funds
The latest movements mark the first public onchain activity from the wallets involved in this theft in a long period. Analysts are now watching to see if these coins are moved to exchanges, which may help identify those responsible or track attempts to cash out.
Blockchain researchers often monitor such wallets for signs of mixing services or coin swaps, which are used to hide origins. While no signs of laundering were reported at the time of writing, past trends show that large moves often precede mixing attempts or efforts to liquidate small portions gradually.
A Web3 analyst from OnchainLens said, “These kinds of movements usually indicate some preparatory steps before liquidation or laundering attempts.” The transfers have been shared across multiple tracking dashboards and are now under close observation by various compliance groups.
LuBian Hack Still Among the Largest in Bitcoin Theft History
The LuBian incident remains one of the biggest known crypto thefts by dollar value. Though other hacks like Mt. Gox involved more bitcoin, BTC’s lower value at the time made their dollar impact smaller. In contrast, the LuBian theft occurred when bitcoin was already gaining value.
The lack of strong internal controls at smaller mining pools was pointed out as a major vulnerability. Investigations in 2021 and 2022 noted how private key access and fund management at LuBian were poorly structured. This made it easier for internal or external attackers to move large sums unnoticed for a time.
There has been little public reporting on the identities of those behind the attack. Law enforcement agencies in China and other jurisdictions have not shared updates, though the stolen coins remain under close watch.
Destination Wallets Under Surveillance
As of now, the four receiving addresses have not made further transactions. However, analysts expect that the wallets may eventually interact with exchanges or decentralized services. These steps could offer new clues if the hackers attempt to convert the stolen funds into fiat or other assets.
The use of mixers, coin swaps, or synthetic assets could further obscure the source of the funds. Blockchain analytics firms continue to flag transactions involving known stolen assets to prevent entry into regulated financial platforms.
The crypto industry has increased its efforts to trace stolen digital assets, especially large bitcoin movements from well-known thefts. Monitoring of these destination wallets will continue in the coming weeks.
