About 64,000 Bitcoin mining machines were reportedly hijacked and redirected to the OCEAN mining pool, sending roughly 13 exahashes per second (EH/s) of computing power to the pool and briefly pushing its hashrate toward 50 EH/s.
Reports said the attack began around 8 p.m. U.S. Central Time on Nov. 14. Mining infrastructure provider CoreX Hosting raised the alarm after detecting unauthorized changes to mining pool configurations, according to the accounts.
OCEAN Hashrate Spike Reflects Redirected Power
OCEAN’s mining dashboard showed a sudden jump as the compromised machines were pointed at the pool. Its hashrate briefly approached 50 EH/s before retreating toward 40 EH/s, and the dashboard later displayed 41.59 EH/s.
The gain reflected redirected computing power, not an equivalent expansion in Bitcoin’s overall mining capacity.
Attackers also changed the mining payout address to a Bitcoin address under their control, but they reportedly mined no Bitcoin block during the incident and received no block rewards.
Diverted Hashrate Falls Sharply
CoreX Hosting later said the attack appeared to have ended on Nov. 15. The hijacked computing power dropped from about 13 EH/s to 100 petahashes per second (PH/s), a reduction of more than 99%.
Even though the attackers failed to mine a block, affected operators lost hashing time that could have generated revenue through their intended pools. The lost mining time cannot be recovered. Available reports did not quantify the financial losses or establish the total number of affected mining facilities.
Luxor Commander Breach Remains Unverified
One affected mining operator said its entire mining farm had been hijacked and identified Luxor’s Commander mining management software as the suspected source of the compromise. Other operators reported similar unauthorized changes to pool configurations several days before the latest incident.
Those accounts raised questions about whether the security breach extended beyond the machines named in initial reports. Neither the full extent of the attack nor the alleged compromise of Luxor Commander has been independently confirmed.
