Approximately 64,000 Bitcoin mining machines' hash power was hijacked, but the attackers failed to successfully mine blocks and obtain profits.

November 15 — Approximately 64,000 Bitcoin mining machines were hijacked, involving about 13 EH/s of hashrate. The attackers redirected the hashrate of these mining machines to the OCEAN mining pool and set the payout address to a Bitcoin address under their control. The attack is said to have begun around 20:00 U.S. Central Time on November 14 (10:00 AM Beijing Time on November 15).

The OCEAN mining pool dashboard showed its hashrate surging sharply in a short period, briefly approaching 50 EH/s before falling back to about 40 EH/s. Mining machine hosting provider CoreX Hosting was the first to issue an alert, stating that some mining machines had been switched to other mining pools without authorization.

One affected mining farm operator said its entire mining farm was hijacked and noted that Luxor's Commander mining machine management software may be the source of this security incident. Other operators also reported similar unauthorized mining pool switching incidents that occurred a few days earlier, which may mean this incident involves a broader attack.

CoreX subsequently said the attack appeared to have ended, with the hijacked hashrate dropping from 13 EH/s to about 100 PH/s. The attackers failed to successfully mine any Bitcoin blocks during the hijacking and therefore received no block rewards. However, the affected miners permanently lost the Bitcoin mining revenue they could have earned during the attack, and this hashrate time cannot be recovered. At present, the full scope of impact of this incident and whether Luxor Commander was compromised have not yet been independently verified.