Approximately 64,000 Bitcoin mining machines were hijacked on November 14, 2026, with roughly 13 exahashes per second (EH/s) of computing power redirected to the OCEAN mining pool. The attackers generated no revenue from the operation, while the machines' legitimate owners suffered permanent loss of mining income.
Timeline and Scale of the Incident
The hijacking began at approximately 8 p.m. Central Time on November 14. OCEAN's reported hashrate jumped sharply to around 50 EH/s before settling at approximately 40 EH/s. The diverted power subsequently fell to about 100 petahashes per second (PH/s)—one-thousandth of an exahash—indicating that most hijacked machines were recovered or disconnected within a short period.
All redirected mining output was sent to a single attacker-controlled payout address that never received any payments.
Suspected Entry Point
CoreX Hosting, a mining operations firm, first identified the problem by detecting unauthorized changes to pool settings on affected machines. One operator reported that their entire mining operation was compromised. The suspected vulnerability is Luxor Commander, a software tool used to manage mining fleets, though this connection remains unconfirmed.
Unauthorized pool changes had already been reported on affected machines in the days preceding the November 14 incident, suggesting possible earlier probing or testing by attackers.
Why Lost Revenue Cannot Be Recovered
Mining income depends on contributing computational work in real time. Once time passes, the opportunity to earn rewards for that work is irretrievable. Every minute the hijacked machines spent mining for attackers represented lost revenue for their owners that cannot be reclaimed.
Implications for Mining Operations
The incident highlights vulnerabilities in operational software rather than Bitcoin's core protocol or consensus rules. Bitcoin's network security remained intact throughout the hijacking. The episode demonstrates how quickly a large block of hashrate can be redirected without owners' authorization.
Mining operators are advised to audit their pool settings frequently and investigate whether Luxor Commander is confirmed as the vulnerability. If confirmed, operators using the software will want details on potential exposures and available fixes. The pattern of earlier unauthorized changes should also receive attention, as it may indicate ongoing probing by attackers rather than an isolated incident.
