Whoever hijacked thousands of Bitcoin mining machines overnight and pointed them at the OCEAN pool has not been paid, but the attack was not a total loss for them either. OCEAN’s own dashboard shows the attacker’s payout address holding about 0.66 BTC worth of unpaid shares, roughly $43,000, which the pool’s payout system would release over its next blocks. The address was still collecting hashrate from a few hundred machines on Sunday afternoon, and the number was growing.
What happened overnight
The first public warning came from CoreX Hosting, a company that hosts mining machines for clients. “Just a heads up, there is a big miner hack going on as we speak,” CoreX Hosting said at 03:08 UTC on Sunday. It said machines were being pointed at OCEAN with payouts going to the Bitcoin address bc1qphukp9rjfc4rcej7erpm9ae20xmtspw8pcddrr.
Under an hour later, CoreX said “the hacker pool address is still sitting at 13EH,” meaning about 13 exahashes per second of computing power. That is about 1.4% of the network, based on mempool.space’s three-day estimate of roughly 932 EH/s. By 06:40 UTC the company reported: “It is over. Hacker is down to 100PH on their pool/wallet.”
Bitcoin News and TokenPost, which put the start at about 8 p.m. US Central time on Saturday, estimated that around 64,000 machines were involved. CoreX has not given a machine count, so that number remains an estimate.
Why “no block” does not mean no payout
Early coverage stressed that the attacker never found a block and so earned nothing. That is only half right. OCEAN pays miners under a system it calls TIDES, in which every block the pool finds pays out to all shares in a rolling window. According to OCEAN’s TIDES documentation, that window holds the latest eight blocks’ worth of work, measured against network difficulty.
The hijacked hashrate earned its place in that window. As of about 14:00 UTC, the address’s OCEAN stats page showed 28.38 trillion shares in the window, out of about 1,078.6 trillion for the whole pool, or 2.6%. OCEAN estimated the address would receive about 0.081 BTC if the pool found a block right away, and put the rewards for all of its shares in the window at 0.658 BTC. At Bitcoin’s price of about $65,300 on Coinbase, that is roughly $43,000.
None of it has moved yet. OCEAN’s last block was 975,869, found at 01:00 UTC, an hour before the hijack started, and the pool had not found another by 14:00 UTC, according to mempool.space. The payout address has no transactions onchain. Mononaut, a developer at mempool.space, put the haul at about 0.657 BTC of shares from OCEAN’s dashboard and said that “ocean hasn’t found any since the hack occurred, so the hacker hasn’t been paid yet.”
The share count also gives a rough sense of the attack’s size. By AltcoinReporter’s calculation, 28.38 trillion shares match about two and a half hours of hashing at the full 13 EH/s CoreX reported.
Still running, at a much smaller scale
CoreX’s “It is over” did not mean the address went quiet. Between 13:59 and 14:04 UTC, OCEAN’s data showed the number of active workers on the address climbing from 340 to 438, and its one-minute hashrate rising from about 27 to 52 petahashes per second. That is a small fraction of the overnight peak, but the share count is still growing.
For the farms, the lost hours cannot be recovered, and they came when margins were already thin. Bitcoin’s difficulty fell 9.13% on Saturday, and miners were still earning less per unit of hashrate than in October.
The cause is still unconfirmed
Nobody has confirmed how the machines were taken over. An account claiming to be an affected operator blamed Luxor’s Commander fleet management software, but offered no evidence. Luxor had not commented publicly by Sunday afternoon. CoreX said it had isolated what it believed was the program involved but would not name it: “I am not qualified enough to point fingers.” It also said, “Not a LuxOS thing. The hack vs any and all miners, even non-BTC miners,” suggesting it did not see Luxor’s LuxOS firmware as the cause.
There may be an earlier incident. On Nov. 10, mining hardware developer skot said customers at a hosting firm had found their pool settings changed without their knowledge, and that the host said Hiveon had told it mining management software was compromised. Skot said on Sunday that those miners had also been switched to OCEAN. Hiveon has not commented publicly.
What to watch
The next OCEAN block is the first test. If the pool finds one while the attacker’s shares are still in the window, about 0.08 BTC should go to the hijacker’s address in that block’s coinbase, and the rest would follow over later blocks. OCEAN, which had not posted about the incident by Sunday afternoon, has not said whether it will treat the address differently. Statements from Luxor and Hiveon, and reports from affected operators, should show how far the breach reached. Changing pools takes nothing more than a new Stratum address in a miner’s settings, as Binance Pool’s customers found when it shut down on Nov. 10. That one setting is what the attacker changed.
FAQ
How were Bitcoin miners hijacked to OCEAN?
Their pool and payout settings were changed without the owners’ permission, pointing about 13 EH/s at OCEAN with an attacker’s address as the payee. The method has not been confirmed.
Did the attacker get any bitcoin?
Not yet. The address has no onchain transactions, but OCEAN’s dashboard credits it with about 0.658 BTC of rewards that would be paid out as the pool finds blocks.
Was the Bitcoin network itself affected?
No. The attack changed settings on mining machines, not Bitcoin’s software or rules, and blocks kept coming as normal.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
