LuBian's Missing Bitcoin: How a Weak Key Flaw Hid a $14.8 Billion Theft for Five Years

A theft first reported in August 2025 concerns 127,426 Bitcoin that disappeared from the LuBian mining pool nearly five years earlier. At the time of the loss, the sum was worth roughly $3.5 billion; by the time it was disclosed, its value had risen to approximately $14.8 billion. For most of that period, the theft drew no headlines, no investigation, and no public acknowledgment.

Credit: Arkham, Mempool, Yahoo Finance, Ledger, CCN, ASecuritySite, Bitcoin.com, CoinTelegraph, CoinDesk, TIME, Reuters, CompassMining, Blockscope, Milk Sad, CoinMarketCap

01Background on LuBian

As of December 2020, LuBian controlled close to 6% of Bitcoin's total network hashrate and marketed itself as "the safest high-yielding mining pool in the world." In February 2021, the pool ceased operations without explanation, a shutdown that coincided with China's crackdown on domestic Bitcoin mining and drew little scrutiny at the time.

In August 2025, Arkham Intelligence published findings identifying 127,426 Bitcoin, previously unexplained, as having been stolen from LuBian — a sum larger than losses from many of the largest centralized exchange collapses on record.

02The underlying flaw

According to the analysis, LuBian's downfall was not the result of a sophisticated attack or a state actor, but a basic cryptographic error. A properly generated Bitcoin private key should carry 256 bits of entropy — around 2^256 possible values, a number that exceeds the estimated count of atoms in the observable universe.

LuBian's key generation reportedly used only 32 bits of entropy, yielding around 4 billion possible combinations — a range brute-forceable by an ordinary computer within hours. The flaw is comparable to the weakness later found in Trust Wallet and Libbitcoin Explorer, where similarly weak entropy generation exposed private keys to the same kind of brute-force recovery. This class of weakness had been understood and exploitable by less sophisticated attackers for years prior.

03Operational context: China and Iran

LuBian, operated by Liu Ping, reportedly maintained its own customs clearance channels, built through prior experience running logistics companies. Part of its mining infrastructure operated in Iran, where electricity cost around $0.006 per kilowatt-hour. LuBian partnered with a local, privately owned power plant — backed by Chinese and Iranian investors and generating power by burning waste — to support this operation.

Liu Ping has described maintaining relationships with Iran's Ministry of Energy, Ministry of Foreign Affairs, and its military — connections that reportedly gave the operation political cover within a sanctioned country. LuBian grew from an unknown entity to nearly 6% of global Bitcoin hashrate within months.

04Timeline of the disappearance

On December 28, 2020, more than 90% of LuBian's Bitcoin holdings were moved out without any public disclosure. In February 2021, LuBian mined its last block and stopped operating. In May 2021, China formally moved against domestic Bitcoin mining, a development that coincided with broader shutdowns of Chinese mining operations and tightening Iranian crypto restrictions in 2021.

At the time, LuBian's disappearance was widely attributed to this regulatory pressure. In hindsight, the closure predates and appears unrelated to the crackdown — the funds had already been taken months earlier. By September 2021, Compass Mining noted that the pool had effectively vanished, though the connection to a theft was not made at the time.

05The OP_RETURN messages

Records show that more than 1,500 messages were sent to the attacker's wallet addresses using Bitcoin's OP_RETURN function, at a combined cost of 1.4 BTC in transaction fees. The messages, sent presumably by LuBian, requested the return of the funds in exchange for a reward. The attacker never responded, and the funds saw no significant movement beyond a basic wallet consolidation in July 2024.

06Current state of the funds

Blockscope's forensic analysis traced the stolen funds across more than 2,200 addresses linked to LuBian's compromised wallets and the attacker's broader network. The analysis found no evidence of mixing or tumbling — only minimal activity consistent with long-term storage, with the last notable consolidation activity observed in 2024, part of a pattern spanning 2020 to 2025.

The holdings now place the wallet among the fifteen largest known Bitcoin holders, ahead of Mt. Gox and most sovereign holders. Roughly one in every 125 Bitcoin in circulation is now held in this wallet network. The value of the stolen funds has grown from $3.5 billion at the time of theft to $14.8 billion as of the August 2025 disclosure, with no indication so far that the holder intends to move or liquidate the assets.

07Broader implications

The theft went unflagged by any exchange, mining pool association, or regulator for nearly five years, despite occurring entirely on a public, auditable ledger. In December 2020, Bitcoin's total market capitalization stood at roughly $436 billion, meaning the $3.5 billion LuBian theft represented close to 0.8% of Bitcoin's total value at the time — a sum far larger than other hacks that drew significant market attention in that period. By August 2025, when Arkham's findings were published, Bitcoin's market capitalization exceeded $2 trillion, and the disclosure of one of the largest crypto thefts on record produced comparatively little market reaction.

Arkham's discovery came from directly analyzing on-chain data rather than through any official investigative process, despite every relevant transaction having been publicly recorded and available the entire time.

The underlying flaw was not unique to LuBian: Trust Wallet was separately affected by the same 32-bit entropy weakness, and the "Milk Sad" disclosure affecting Libbitcoin Explorer points to the same category of weak key generation appearing across multiple pieces of crypto infrastructure.

Notably, LuBian's operators are reported to still control 11,886 Bitcoin, worth roughly $1.38 billion, separate from the stolen funds — a portion of the operation that survived the incident.